My policy is that I shut down the server, I create a fresh server for the user and then I attach the old disk read-only to that server, in case the user needs t

My policy is that I shut down the server, I create a fresh server for the user and then I attach the old disk read-only to that server, in case the user needs to retrieve data. The problem is that there is no way to 'clean up' after a break in without booting from trusted media. Otherwise, there is no way to know if you have closed all the backdoors the attacker left.