 |
 |
> 4) Server compromised. Worst case scenario. They need to preserve all > the drives so they can analyze them and turn over information to > police. This is where written policies and reality often diverge. Getting LE involved is tantamount to throwing away production equipment making a bad situation much worse on multiple levels. I'd be willing to bet that most people quietly clean and rebuild, especially if they're not budgeted for a backup system... kyle