That was my concern as well. First thing I learned early on was that when you suspect that a server is compromised, or you you just deleted something super crit

That was my concern as well. First thing I learned early on was that when you suspect that a server is compromised, or you you just deleted something super critical, is to dd it to an image and then mount it ro for forensics.