21.2 Cleanup, Restoration, and Artifact Preservation

Objective 5.4 is cleanup and restoration. This is professional closeout, not anti-forensics to hide from the client. You leave the network as authorized: your persistence, accounts, tools, and attack infrastructure gone; their systems returned to the agreed baseline; proof of what you did saved for the report. The destination of preserved artifacts is the penetration test report in Chapter 4 (objective 1.4). Screenshots, hashes, tester logs, and reproduction notes belong in detailed findings and the attack narrative, under the engagement's documentation specifications. They do not belong on a forgotten C2 disk six months later.

Cleanup is the inverse of Domain 5 work you already did. Persistence (5.1) taught how scheduled tasks, services, accounts, shells, and C2 landed. 5.4 is how that comes out. Staging and exfiltration (5.3) taught how a scoped sample left. 5.4 is how copies in tester custody die when the SoW says they should.

Preserve artifacts first

CompTIA lists preserve artifacts with the cleanup bullets, but the order is preserve before you tear the lab down. If you delete the web shell and then remember you never screenshotted the URL, the finding is a story without evidence. Capture, at minimum:

• Screenshots of the foothold, the staged sample, and the successful scoped exfil
• File hashes (SHA-256) of tools you dropped and of the sample you touched
• Command history, proxy logs, and C2 session metadata from tester systems
• Hostnames, IP addresses, account names, timestamps, and the change log of what you altered

Those artifacts feed Chapter 4. Then you clean.

Exam trap: reading "preserve artifacts" as "keep the payroll database on a laptop until next year's retest." Preserve proof. The client data you copied is later subject to secure data destruction. Trap two: wiping the C2 virtual private server (VPS) before you export the logs the attack narrative needs. Trap three: putting unredacted payment-card numbers or electronic protected health information in an appendix when a hash and a cropped screenshot already prove access (1.4 legal and ethical reporting).

Remove persistence mechanisms, tester-created credentials, and tools

Remove persistence mechanisms means removing what you installed: scheduled tasks and cron jobs, new services, registry Run keys, startup folders, web shells, reverse-shell callbacks, implants, tester browser extensions, and any security-control tampering you used to stay alive (5.1). Identification: "the tester's cron job still fires after the window." The answer is remove tester persistence. Trap: deleting the customer's nightly backup task because it "looked like persistence." You remove yours. Their legitimate tasks stay.

Remove tester-created credentials is every local user, domain account, API key, SSH key, certificate, service principal, and cloud IAM user you added. Delete or disable them. If you reset a password to get in, coordinate restoration with the client — do not lock production administrators as a cleanup surprise. Trap: leaving a "backup" local Administrator named pt-retest "in case we come back." That is an unauthorized account, not a courtesy. Trap two: disabling the CISO's real account because it is privileged. You did not create it.

Remove tools is binaries, scripts, packed archives, and staging directories you dropped on their hosts — C:\Temp\pt-tools, a Python dropper, a copied scanner build, the encrypted virtual disk you mounted. Delete those paths. Do not "clean" by removing cmd.exe or a Sysinternals binary the customer already owned because you used it as a living-off-the-land binary (5.2). Trap: uninstalling their endpoint-detection console. That is vandalism, not tool removal.

Spin down infrastructure and revert configuration changes

Spin down infrastructure is your attack platform: the C2 VPS, phishing redirectors still running, cloud buckets you used as drops, VPN jump boxes, lab DNS zones, and any cross-account resources you created for 5.3. Terminate the instances. Confirm the public IP addresses are gone. This is infrastructure you brought. Trap: terminating the customer's misconfigured jump host or their production compute because "spin down means virtual machines." Their estate is not your lab.

Revert configuration changes puts your edits back: firewall or security-group rules you opened, registry values you set, audit policy you lowered, antivirus or EDR exclusions you added, a hosts-file redirect, a service you started, an IIS handler you enabled for a shell. Keep a change log during the test so cleanup is a checklist. Identification: "testers added an any/any rule on the lab firewall to pivot." Cleanup removes that rule. Trap: "reverting" by reverting a production virtual machine to a week-old snapshot, wiping a week of their logs. Revert your edits. Do not roll the enterprise.

Secure data destruction — and what you must not destroy

Secure data destruction applies to client data in tester custody: the sample you copied, memory dumps, mailbox extracts, database snippets, and screenshots that hold more personal data than the report needs. After the report is accepted — or on the retention date in the SoW and documentation specifications — destroy tester copies with the method the engagement named: cryptographic wipe of the volume, shred of the encrypted archive, deletion of the cloud drop after you confirm you no longer need it. The nondisclosure agreement already said you do not keep trophies.

What you must not destroy: the client's original logs, EDR telemetry, backups, or security-information and event-management (SIEM) indexes. Deleting those is out-of-scope vandalism, not cleanup. PenTest+ cleanup is restore and disclose. The client is supposed to see what you did, in the Chapter 4 report, and their blue team is supposed to keep their evidence.

Worked contrast on the same IIS host:

• You uploaded cmd.aspx. Required: screenshot and hash the shell first, then remove that web shell, revert the handler if you changed it, delete the tester local user, unmount and delete the virtual disk, shred the encrypted payroll sample on your laptop, and spin down the C2 VPS.
• You do not purge C:\inetpub\logs, do not clear Security event logs, and do not wipe the SIEM. Those are their artifacts.

free PenTest+ practice questionsPractice questions with detailed explanations

Closeout sequence the exam wants

1. Stop new testing at the window end.
2. Preserve artifacts (proof for the Chapter 4 report) first.
3. Remove persistence, tester-created credentials, and tools.
4. Revert configuration changes from your change log.
5. Spin down tester infrastructure (C2 VPS and drops).
6. Securely destroy client data in your possession per the SoW, once the working copy is no longer required for the report.

Do not skip step 2. Do not expand step 6 into their SIEM. Do not treat cleanup as hiding from the security operations center. Exfiltration (5.3) proved impact inside RoE. Cleanup (5.4) is how a professional engagement ends so the only lasting copy of the story is the report the client asked for.