Post-Exploitation and Lateral Movement · Topic 3 of 5
Cleanup and Restoration
Learn how testers clean up after a penetration test: removing tools and accounts, restoring settings, handling data and confirming with the client.
- 4 min
- Cleanup removes tools, accounts, persistence, test data and configuration changes made during the test.
- Record every change as it happens so that it can be reversed.
- Verify each removal and confirm the final list with the client.
What it is
Cleanup is the final technical step of an engagement. The tester removes everything that the test added or changed, restores original settings, and handles collected data as agreed.
An attacker would try to hide traces. A professional tester does the opposite: cleanup is about leaving the client's systems safe and giving the client a full account of what was done.
How it works
Why it matters
Anything left behind can become a real weakness. A test account with a known password, a backdoor script or a disabled security control could be found and used by a real attacker.
Cleanup also protects the tester. A clear record of changes and removals shows that the test stayed inside its rules.
What counts as an artifact
| Artifact | Example |
|---|---|
| Files and tools | Uploaded programs, scripts, scan output on client hosts |
| Accounts and credentials | Created users, added group memberships, new keys |
| Persistence items | Scheduled tasks, services, startup entries, web shells |
| Configuration changes | Altered firewall rules, disabled security tools, changed permissions |
| Network changes | Open ports, tunnels, port forwards, proxy settings |
| Data copies | Samples collected as evidence, screenshots, memory dumps |
| Cloud resources | Test instances, storage buckets, keys and roles |
Keeping a change log
The key habit is to record each change at the moment it is made. The record should include the host, the item, the time and the person.
A simple table works well.
| Time | Host | Action | Cleanup status |
|---|---|---|---|
| 10:42 | Web server | Created a test file in the web folder | Removed and verified |
| 11:05 | File server | Added a temporary account | Deleted and verified |
Without this log, the tester has to search for traces, and some will be missed. The log later feeds the report and the attack narrative.
Removal and restoration steps
The general order is simple.
- Stop any running tools, listeners and tunnels.
- Remove created accounts, keys, tasks, services and files.
- Reverse configuration changes, such as turned-off protections or modified permissions.
- Delete test resources in cloud accounts.
- Verify each removal, not just assume it.
- Share the final list with the client so that they can check it.
Some changes cannot be fully reversed by the tester, for example data that was altered or a service that crashed. These must be reported honestly, and the client's team should be involved in the repair.
Logs and evidence
A common exam trap is log handling. A tester does not erase the client's logs or tamper with them, because the logs are the client's evidence and are how defenders learn from the test.
The tester keeps their own records instead. These include timestamps, commands run, tool output and source addresses, so the client can separate test activity from any real attacker.
Handling collected data
Evidence and any sensitive data collected must follow the rules of engagement.
- Store it encrypted, on approved systems only.
- Share it only through secure channels.
- Keep it for the agreed period, then destroy it securely.
- Record the destruction.
A good practice is to collect as little as possible. For example, a screenshot of a file listing proves access without copying the files.
Verification
After cleanup, the tester and client may run a quick scan or review to confirm that nothing remains. Some clients ask for a short attestation or a closing meeting, and a retest later checks the fixes.
Never delete, edit or clear the client's logs to hide test activity, because that destroys evidence and can look like a real intrusion cover-up.
What to remember for the exam
- Cleanup removes tools, accounts, persistence, test data and configuration changes made during the test.
- Record every change as it happens so that it can be reversed.
- Verify each removal and confirm the final list with the client.
- Do not tamper with client logs, since cleanup is not evasion.
- Report changes that cannot be reversed, such as altered data or crashed services.
- Collected data is stored securely, kept for the agreed period and then destroyed.
- Cloud test resources, keys and roles must be deleted too.
- Minimise the data collected as evidence.
Common mistakes
Cleaning from memory. Without a log, small items such as a scheduled task are missed.
Wiping logs to tidy up. Logs are the client's evidence, and removing them breaks trust and may violate the contract.
Forgetting cloud and network leftovers. Test keys, open ports and tunnels count as artifacts.
Not telling the client. Any lasting change must be disclosed, even if it was accidental.
Keeping data indefinitely. Retention beyond the contract creates new risk.
Check yourself
Why must a tester keep a change log?
So every file, account and setting changed during the test can be found, reversed and verified.
Should a tester clear the client's logs after testing?
No, because the logs belong to the client and are evidence, so the tester keeps separate records instead.
What happens to evidence data when the retention period ends?
It is securely destroyed, and the destruction is recorded.
Topic 3 of 5 in Post-Exploitation and Lateral Movement
Test yourself on Post-Exploitation and Lateral Movement
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.