Invasion Investigation · Part 4
Crossing the tape
Everything so far has been a record about your site — Google’s index, Google’s reports, your server’s log of visitors. None of it is the site itself. You could read all of it from a phone in an airport and change nothing.
That ends here. From this point you’re touching the thing itself, and every action costs something.
So before anything else, the rule that governs the rest of this series:
Destroy nothing. Take nothing. Leave nothing. Run nothing.
Destroy nothing — on a compromised site the evidence and the infection are the same files. Take nothing — copy, never move; where a file sits is evidence in its own right. Leave nothing — everything you add becomes something you’ll later have to rule out. And run nothing: typing a suspicious file’s address into your browser doesn’t show it to you, it executes it, on your own server, on demand.
The one step you rush
Everything in this series says slow down. This post is the exception, and the reason is uncomfortable.
The scene may not be empty.
From the case file. In this compromise the operator was watching. A replacement WordPress install appeared the day after discovery. In February, a payload replicated itself into ten hidden directories while the owner watched it happen. His own WordPress access had already stopped working by the day of discovery, and the fight over their administrator accounts — deleted as fast as they were created — ran on for weeks after that.
Weeks of that. It is not a cold trail with a tidy end date — it’s a room with someone still in it.
Working slowly and carefully through a live scene is how you lose it. They redeploy behind you into places you’ve already cleared, and every move teaches them you’re active.
So the tempo goes: patient outside, fast at the threshold, patient again once you’re holding a copy.
Take the capture first
The capture is the whole point of this post. It’s a photograph of the scene, and it’s the only action available that is both fast and completely non-destructive.
Take everything, not just the website that looks wrong:
- Every domain in the account, including the dormant ones
- Above the web root, as far as your access reaches
- A database export for each site — separate from any backup rotation, named so nobody tidies it away
- All the logs you downloaded in Part 3
One archive, one moment in time, off the server.
The part a backup won’t contain
A file capture misses an entire category of evidence, and this is where persistence hides.
Screenshot your control panel. DNS records. Redirect rules. Cron jobs. FTP accounts. SSH keys. Email forwarders and filters. Remote database access rules.
From the case file. A redirect rule that caused serious damage on this site lived in the hosting account’s domain settings, not in any file — the owner could edit it but not delete it, which is how he established that someone at the hosting company had created it. No filesystem backup would ever have contained it.
Separately, one domain in the account had remote database access set to allow connections from any host on the internet. Also not a file. Also invisible to every backup.
Configuration isn’t files. Backups don’t cover it, and it’s precisely where access is kept.
And the trap that follows you home
From the case file. The capture in this investigation is a 1.02 GB archive of 45,369 files, and it’s the reason there was anything to re-examine six months later.
But when it was extracted for analysis, the extraction rewrote every modification date to the day it was unzipped. Almost every file in the working copy carries the same timestamp — the moment it was unpacked, not the moment it was written. The timeline, which is the single most valuable thing in a compromise, was destroyed in the copy while remaining perfectly intact in the archive.
Read timestamps from the archive index. Never from the extracted files.
Then ask one question: is anyone still here?
Not a full investigation. A short list, answered quickly, to establish whether you’re in a live scene or a cold one.
- What changed in the last 48 hours? Sort by modification date and look at the top.
- Who has an active session? WordPress lists logged-in devices per user.
- Which administrator accounts exist, and when were they created? Sort by registration date and read every one — including the names that look native. Especially those.
- Is anything scheduled? Rogue cron entries rebuild deleted files on a timer.
- Do your own credentials still work?
That’s the threshold assessment. Not “what happened,” just “is this still happening.”
They must not know you’re looking
This is the rule that makes everything else possible, and it runs against every instinct.
What announces you, roughly loudest first:
Installing a security plugin. A new plugin appears, scanner traffic starts, and anyone with file access sees it within minutes.
Deleting their files or accounts. A foothold that checks for its own presence redeploys — and it redeploys somewhere you’ve already looked.
Changing passwords, blocking their address, adding rules. Each one announces exactly what you know. Blocking an address teaches them to rotate, and costs you the one identifier you had.
Opening a suspicious file in your browser. Executes it, and writes your own address into the log you’re about to read.
Maintenance mode, or taking the site down. Unmistakable.
And your email. If a forwarder was added at the account level, your correspondence with your host about the compromise is being read by the person you’re investigating. Use a channel that doesn’t run through the compromised account.
The mistake worth naming
Deleting their administrator accounts feels like the most direct possible action. It is also a fight with terrible odds.
Recreating an account is one database query for them — instant, free, repeatable, and part of a tool that takes a list of sites. Removing one is manual and slow for you. You cannot win an attrition war against automation, and every round confirms you’re active.
Deleting their accounts before you’ve closed the way in isn’t remediation. It’s provocation.
The order that actually works is the reverse: find the entry point and close it, rotate the security keys so existing sessions die, then remove the accounts — at which point there’s nothing left to recreate them.
Why the capture is what buys your invisibility
Here’s the part worth understanding, because it explains the whole sequence.
Once you hold a complete copy, the entire investigation happens somewhere they can’t see. Your own machine, your own time, for as long as it takes. They can’t watch you read.
The snapshot isn’t only preservation. It’s concealment. It converts a live scene you have to tiptoe around into a static one you can take apart at leisure — which is why the next post can be as slow and thorough as it likes.
Start the log now
From this moment, you are also making changes, and future-you needs to be able to subtract you from the evidence.
Write down, as you go: where you looked, what you saw, what you flagged, and anything you changed with the exact time you changed it.
And record which clock you’re using. Server time, control panel time and your own computer may disagree, and an investigation with three unlabelled timezones produces correlations that are simply wrong.
From the case file. Notes written five days after discovery, while looking at the screen — recorded database credentials that were verified against the recovered artifact seven months later and matched exactly. That’s not tidiness. That’s a finding that stayed a finding, and it only exists because someone wrote it down before understanding what it meant.
The exception to all of it
If harm is actively ongoing — payment details being captured, visitors being sent to malware right now — you stop the bleeding first and accept the evidence cost. That’s the correct call and it isn’t close.
Rare, but it needs saying, or this reads as be patient while your customers get infected.
Everything else — spam quietly earning somebody money for months — can afford two more days of silence, and those two days buy the whole picture.
What you can do yourself, and what you can’t
The control panel screenshots are yours, and they’re genuinely valuable. So is the written log, the note of which clock you’re on, and the discipline of not touching anything.
The capture usually isn’t — a complete archive of every domain, above the web root, with database exports, is a job for someone with proper access. If you can only do one thing while you wait for them: stop changing things. Every deletion made in the meantime is evidence spent.
And if you take one instruction from this entire series, make it this: the only thing you ever rush is the copy.
Back: How to Read Your Server Access Logs After a Hack
Evidence degrades fastest in the first few days, usually at the hands of the owner. Preserving what the attack left behind is the step that keeps every later answer possible.
Start a Recovery ReviewPaid assessment · scope agreed up front
Next: Investigating the Scene → — the slow pass. Timestamps, clusters, how they hide, and everything inside WordPress that never shows on the plugins page.
Hub: Invasion Investigation Blog Series
ProVAE builds and recovers websites in Douglas, Georgia, serving South Georgia.