You're making the assumption here that it's only recording when the hands are on the wheel. Presumably it also records when the hands are off the wheel. So if the crash happened at (to completely make up a timestamp) 13:24:01.123, and the latest log entry says at 13:24:01.108 the hands were off the wheel, that would be good reason to say that the driver did not have their hands on the wheel at the time of the crash.

Of course, I don't actually know what the logs look like, but I'd rather err on the side of assuming that the designers of a real-time system for monitoring something related to driver safety took into account the idea that, when the car is involved a severe crash, they should have as much accurate data recorded as possible rather than leaving it sitting around for ages in un-flushed caches.