# Phase 4 & 5: Eradication and Recovery

After the attacker is contained in a box and can no longer move, you must remove them from the environment and get the business back online safely.

## Phase 4: Eradication
Eradication is the actual removal of the threat.

*   *"Whack-a-Mole" is not a strategy.* You cannot just delete the single malware file you found and call it a day. If you missed a persistent backdoor in the registry, the attacker will be back in 5 minutes.
*   **Complete Removal:** You must delete malware, remove malicious scheduled tasks, delete attacker-created user accounts, and fix the vulnerability that allowed them in the first place (e.g., patching the exploited firewall, or implementing MFA).
*   **Nuking from Orbit:** Because advanced malware is so good at hiding, standard IR practice is often to skip manual deletion. Instead, the infected machine's hard drive is completely wiped, and the OS is reinstalled from a known-good, pristine image. "When in doubt, wipe it out."

## Phase 5: Recovery
Recovery is the process of putting the systems back into the production environment and ensuring they are clean.

*   **Restoring from Backup:** If a machine was wiped (or encrypted by ransomware), the data must be restored from secure, offline backups.
*   **Reconnecting:** Slowly and carefully moving the repaired systems out of the Quarantine VLAN and back into the production network.
*   **Enhanced Monitoring:** The days following recovery are critical. The IR team will place the recovered systems under extreme scrutiny, looking for any signs that the eradication failed and the attacker has returned.
*   **Business Continuity:** Restoring normal business operations, which might involve bringing email servers back online or reopening customer portals.