I'm curious about this as well.
Near as I can tell, a person leaves lots of timestamps behind unless they do well on a Mask Function, which seems similar to covering up footprints as you go along, or at least leaving fewer tracks in the first place. As for cleaning up the timeline of an object such as the safe in the example, I'm guessing Archival tools and appropriate credentials are necessary, so that you could more easily modify the archives of something your crew owns, while doing so with someone else's item would be trickier.
For a heist, I noticed Intrusion tools leave a detailed trace, so I imagine a competent team could do it by cracking the safe open with intrusion tools, using Mask or Ping, and then someone with skill in Restore would use Archival Tools to remove that trace by overwriting it with details from a "clean" snapshot.