A server compromised by an attacker with administrative rights has been contained. Analysts removed the malware they found, but cannot be certain they found every change the attacker made. What is the BEST approach to recovery?

When an attacker has had administrative control of a system, it is very difficult to establish that every modification has been found: rootkits, altered binaries, new accounts, scheduled tasks and configuration changes can all persist without detection. Rebuilding from a known-good, hardened image and restoring only data that has been validated as clean removes uncertainty about the system's integrity. Applying the fixes for the original entry point during the rebuild prevents recurrence. Running a full antivirus scan and returning the server if no detections occur relies on signature-based tools that may not recognize custom or legitimate-tool persistence, so a clean result is not assurance of integrity. Deleting only the malicious files already identified is exactly the incomplete cleaning the analysts are uncertain about. Restoring the most recent full backup regardless of its date risks reinstating a copy made after the compromise, complete with the attacker's changes. Exam caveat: rebuilding may cost more time than cleaning, so the business owner should understand the trade-off, but where integrity cannot be established, rebuilding is the defensible choice. Operational check: confirm the image source and its integrity, the hardening and patch level applied and the validation of restored data before return to service.