Andy Bastien wrote:
>
> Is it really necessary to buy new hard drives? Is there a reason why
> he can't just reformat his current drives before reinstalling?
>
One could simply reformat, but I'd strongly consider buying new drives
for several reasons:
1) Hard drives are one of the more failure-prone components (and,
unless you're running RAID, harder to quickly swap out a failed unit
than a failed power supply or something). As long as the machine is
down, might as well replace the old hard drives with brand new ones.
2) Good opportunity to re-evaluate your partitioning scheme on the
affected machine. (true, this can be done to some extent by
re-formatting)
3) Good opportunity to install higher-capacity (and possibly
higher-speed) drives.
And, finally, keeping the original hard drives around may or may not be
useful in studying the intrusion, the effects of the intrusion, and the
tools/methods used.
--Rich
_________________________________________________________
Rich Puhek
ETN Systems Inc.
_________________________________________________________
