My hard drive was accessed by an attacker. I'm concern that my root certificates might have been compromised or a rogue certificate was installed to perform MiTM attacks against my SSL connections through my router or ISP. Reviewing my event logs, it looks like a certificate was installed/updated when I was away from my computer (It was in sleep mode). Should I delete all of the certificates and regenerate them? Is this possible or necessary?
Also, are there any signs that data recovery might have been performed on a hard drive? I noticed many of my system files have modified times that can't be explained because I was away from my computer at those times. I ran a malware and rootkit scan and everything appears to be fine. Firewall also appears to be fine.