View source for Compromised System

== '''Step 2) Back up data from the compromised host. We make 2 copies''' ==


Task 1: Rsync back of compromised host from the backup server (it is because migration tools amost always miss something. This task will give you a complete copy of the old system)
  rsync -av -e ssh root@<IP>:/ /var/backups/<IP>/

Task 1: On the compromised host, create a Plesk Backup
  mkdir /root/backups

PSA 7.5 and lower
  /usr/loca/psa/bin/psadump -f | split -b1000m /root/backups/backup.
 
PSA 8.0 and higher
  /usr/local/psa/bin/pleskbackup all --split=1G /root/backups/backup


Task 2: Rsync back of compromised host from the backup server (this gets those backups too):
  rsync -av -e ssh root@<IP>:/ /var/backups/<IP>/