Isolate the affected server, preserve useful evidence, and treat the incident as a possible compromise of the host’s accounts and connected systems—not just a suspicious file to delete. For servers with privileged compromise, uncertain scope, or suspected rootkit persistence, plan on rebuilding from a trusted source rather than relying on an in-place cleanup.
The response sequence below draws on CISA’s Federal Government Cybersecurity Incident and Vulnerability Response Playbooks, its #StopRansomware Guide, and a joint CISA, FBI, and NSA advisory dated January 11, 2022. These are general incident-response sources, not Linux-distribution-specific procedures. The right evidence-collection method and rebuild steps depend on the server, hosting environment, and investigation needs.
As an Amazon Associate I earn from qualifying purchases.
1. Coordinate the response and contain the server
Follow your organization’s incident-response plan if it has one. Identify the suspected server, connected systems, and network segments that may be affected. Coordinate containment with the people responsible for security, infrastructure, and essential services: changes can interrupt operations, and an adversary may react to signs of discovery.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose the narrowest isolation that reasonably limits spread, widening it if multiple hosts or segments appear compromised. CISA’s playbooks describe host-based, internal-network, and perimeter containment. Possible measures include disconnecting a public-facing system, restricting network access, closing specific ports, changing firewall filters, and blocking and logging known malicious traffic.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
| Containment approach | When it may fit | Trade-off to consider |
|---|---|---|
| Host-level isolation | The affected server can be isolated individually and the scope appears limited. | May preserve service on unaffected systems, but is inadequate if other hosts or paths are compromised. |
| Network- or segment-level isolation | Several systems or subnets may be affected, or individual host isolation is not feasible. | Can limit broader spread, but may disrupt more services; weigh continuity and evidence needs. |
Do not make powering off the automatic first move. CISA warns that shutdown can destroy volatile evidence; use network disconnection or isolation where feasible. Its guidance reserves shutdown for cases where disconnection or network isolation is not possible. In a cloud environment, consider taking a volume snapshot for later forensic review.
2. Preserve evidence and determine the scope
Before eradication or other destructive changes, preserve relevant evidence when feasible. Depending on the environment and available expertise, that may include logs, system images, memory capture, or cloud volume snapshots. Record a timeline and the suspected entry point, affected services, network connections, accounts, and observed indicators.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Review available logs and detection data for earlier access, additional affected hosts, malicious infrastructure, and signs that the intrusion began before the malware was noticed. The CISA, FBI, and NSA advisory recommends collecting and reviewing relevant logs, data, and artifacts, and considering third-party expertise to help establish scope and avoid leaving access behind. Collection methods are not universal: distribution, hosting platform, incident conditions, and forensic requirements all matter.
Recommended Free Tools
3. Choose eradication or a clean rebuild
Plan eradication around the possibility of multiple attack paths and persistence mechanisms. CISA’s federal playbook calls for removing incident artifacts and reimaging affected systems from a clean backup or trusted gold source; it specifically calls for rebuilding hardware if rootkits were involved.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
| Recovery route | Use it when | Important limit |
|---|---|---|
| Targeted remediation on the existing system | The scope and persistence mechanisms are well understood, and responders can credibly remove the incident artifacts. | Removing visible files or passing a malware scan does not by itself establish that a compromised host is trustworthy. |
| Reimage or rebuild from a clean source | There was privileged compromise, scope is uncertain, or persistent access is suspected; it is required by CISA’s playbook if rootkits were involved. | Use a trusted gold source or clean backup, and retain the original system and evidence as appropriate for investigation. |
The guidance does not set a universal threshold for every case. Compare confidence that persistence has been removed, the extent of privileged compromise, evidence-preservation needs, service downtime, and whether a clean image or backup is available. A scan can be one verification activity, but CISA does not say that one scan certifies a host as clean.
4. Rotate credentials and revoke access that may be exposed
As part of containment and recovery, change administrator passwords, revoke privileged access, and rotate private keys and service or application secrets suspected of compromise. Include credentials and tokens the server could access—for example, those used for deployment, backups, cloud resources, or monitoring—when the incident’s scope makes them relevant. Do not limit the review to passwords stored locally on the host.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
5. Restore services from clean sources
Use backups that are known or reasonably assessed to be clean. CISA recommends offline, encrypted backups, regular restoration testing, and gold images. A removable drive alone does not make a backup plan safe: isolation, access controls, and successful restoration tests matter too.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- Prepare a clean recovery environment and select the trusted image or backup for each service.
- Restore critical services in priority order, keeping the recovery environment isolated as appropriate.
- Validate restored data and service behavior before returning systems to normal network connectivity.
- Reconnect only systems assessed as clean, taking care not to reintroduce malware through the restoration process.
6. Monitor for renewed activity and document the incident
Monitor restored systems and the surrounding environment for renewed attacker activity or persistence during recovery. If new activity appears, contain it and return to technical analysis to reassess scope and identify the actual infection vector. Document the timeline, findings, response decisions, and lessons learned, then update incident plans and controls.
CISA’s federal playbook states: “Upon successful containment (i.e., no new signs of compromise), preserve evidence for reference and law enforcement investigation (if applicable), adjust detection tools, and move to eradication.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
