Space Engineers have a guide for that:

Didnt the article say they retrieved the filename and hash, thus proving the existence of the crash diagnostic snapshot. After which Tesla handed over their copy?

Or did the forensics retrieve the actual data?

Edit: Given the importance of this type of data, not saving it to non-voletile memory is negligent at best. Even if it required a huge amount of space, they could delete unimportant files like the Spotify cache or apps or whatever