Last week I had a linux debian distribution accessible from Internet compromised through SSH for 24 hours. As far as I know the attacker could get root privileges and performed some malicious actions.
The attacker deleted the .bash_history file, the entire /var/log folder and rebooted the machine.
I've been trying to recover inodes from deleted logs but debugfs does not show results. The command "last" does not show as log file was deleted. The file "/var/log/auth.log" was deleted as well (as I said, entire /var/log directory was deleted).
Don't know where to look as this is a standard distribution with no additional packages installed, as almost all tools uses /var/log folder for storing that kind of information. Any ideas?