The Instinct That Destroys the Case

It is seven in the morning. Your site is showing somebody else's message, or your hosting provider has emailed about outbound spam, or a customer has asked why your login page looks different. Your hand is already moving toward the reboot button.

That instinct is correct about the goal and wrong about the order. You do want the site back. But a running machine is holding the only copy of several things that will not survive the power cycle, and once they are gone no amount of later work brings them back.

What dies with the power

A compromised machine is not just a filesystem. Most of what tells you what is happening lives in memory, and memory is not written down.

Which processes are running, and what command started them
Open network connections, and who is on the other end
A program running from a file it already deleted
Anything decrypted, including keys held only in RAM
The attacker's shell, if they are still holding it

Files on disk, and their timestamps
Logs that were flushed before the reboot
Anything the attacker deliberately left behind

The sharpest example is a process running from a deleted file. An attacker starts their program, then deletes it from disk. The file is gone from every listing, but the running process still holds it open — so while the machine is up the kernel will hand you the binary back, and once it is down it never existed.

$ ls -l /tmp/.x
ls: cannot access '/tmp/.x': No such file or directory
$ ls -l /proc/2481/exe
lrwxrwxrwx 1 root root 0 Aug 14 07:12 /proc/2481/exe -> '/tmp/.x (deleted)'
$ cp /proc/2481/exe /evidence/recovered-2481
$ sha256sum /evidence/recovered-2481
9f2b1c4e...  /evidence/recovered-2481

Reboot that machine and every line above stops working. The process is gone, /proc/2481 is gone, and the only copy of the thing that was running on your server has been deleted by you rather than by the attacker.

Restoring from backup has the same problem, twice

Wiping the box and restoring last night's backup feels safer than a reboot. It is usually worse, for two reasons that compound. The first is the same one: you have destroyed the evidence, and now you cannot answer how they got in. The second is that you do not know *when* the compromise happened, so you do not know whether last night's backup already contains it — and restoring a backdoored backup gets you a clean-looking site that is still theirs.

There is one honest exception, and it is not a technical one. If what is on the screen is doing active harm — illegal content, or something that puts a person in danger — it comes down first and the forensics happen afterwards. That judgement is the subject of the next lesson.