Why Reinstalling a Compromised Server Can Destroy Evidence

Reinstalling a compromised server is one of the most common — and most damaging — responses to a security incident. The server may appear clean afterward, but the investigation becomes significantly harder.

What reinstallation removes

A fresh installation eliminates file timestamps, memory-resident malware, web shells, modified configuration files, and attacker-created accounts. These artefacts often reveal how access was obtained and whether persistence mechanisms remain elsewhere.

When reinstallation is appropriate

Reinstallation may be necessary after evidence has been preserved through disk imaging, log export, and memory capture. The sequence matters: preserve first, then remediate.

Alternative containment approaches

Network isolation, account disablement, and service suspension can contain an active threat while preserving the environment for investigation. Document every containment action with timestamps.

The investigation question

Removing malicious code answers "how do we clean this?" Investigation answers "how did this happen?" Both questions matter, but they require different approaches and different timing.