Restore a lab host from your cleanup list and prove it

short · 50 min · Objective 5.1

Task

Take a lab host you compromised and modified across earlier labs, restore everything you changed from the cleanup list you kept, and prove the host matches its pre-engagement state — while keeping the one thing you must not remove: the host's own record of your activity.

Steps

  1. On the lab you own, take a VM you modified in an earlier lab, and the cleanup list you kept as you worked: files dropped, processes started, accounts created, configuration altered, persistence placed.
  2. Reverse each item on the list, in order, recording as you go.
  3. Do not remove the host's own logs of your activity — the client needs those, and removing them is anti-forensics, not cleanup.
  4. Compare the host against its pre-engagement snapshot: what differs now should be only the logs and any change the client agreed you would leave.
  5. Record the restoration in /tmp/restore.md: each item and confirmation it was reversed.
  6. Note why this is an obligation to the client, not tidiness.

Verify

grep -cE "^reversed:" /tmp/restore.md
grep -ciE "log|activity record|not remove|kept" /tmp/restore.md
grep -ciE "matches|snapshot|only difference|restored" /tmp/restore.md

The first count must be non-zero: you reversed the items on your cleanup list. The second must be non-zero: you explicitly kept the host's activity logs — removing them is anti-forensics, and the report objective depends on them. The third must be non-zero: you confirmed the host matches its pre-engagement state apart from the agreed exceptions.

Notes

The cleanup list is started on day one, not at the end — which is why the earlier labs built it as they went. What you must NOT remove is the client's own logs of your activity: cleaning those is anti-forensics, and lesson 40's attack narrative and lesson 41's remediation both depend on them. Restoring a client's system is an obligation, not tidiness. Everything ran on a disposable VM you built, with the snapshot as the backstop the cleanup list should not need.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.