The attacker could have used a script like this: use foobar db.collection.find() db.dropDatabase() and then: cat script.js | mongo | tee backup so t

The attacker could have used a script like this: use foobar db.collection.find() db.dropDatabase() and then: cat script.js | mongo | tee backup so there is indeed a plausible way to backup the database before dropping it. The timestamps seems to be as well plausible for a small database.