This is a case of social engineering, not of a security auditor, but of the poster. The poster wants to know an easy way to collect public and private SSH keys and fake 6 months of inbound traffic. There is no auditor.
Maybe the poster is writing a book on cracking systems? Who knows. But it smells like a hoax.
What is 'hard' about harvesting public and private keys? Especially if you are the sysadmin.
What purpose would faking 6 months of inbound traffic serve? If he just wanted to cover his tracks, wouldn't he just erase logs rather than trying to make them look legit? That would seem like doing things the hard way.
Maybe the poster is writing a book on cracking systems? Who knows. But it smells like a hoax.