> 4) Server compromised. Worst case scenario. They need to preserve all
> the drives so they can analyze them and turn over information to
This is where written policies and reality often diverge. Getting LE
involved is tantamount to throwing away production equipment making a
bad situation much worse on multiple levels. I'd be willing to bet
that most people quietly clean and rebuild, especially if they're not
budgeted for a backup system...