Recover in Stages

Containment gives you time to clean up. Keep a computer isolated while you preserve evidence and remove the unwanted process, file and startup entry.

Once cleanup is complete, return that computer to service and verify its approved work. Then repeat for the next affected computer. This makes it easier to spot which recovery step caused a problem.

For example, a cleaned practice computer can return to the network:

seclab host practice-laptop reconnect

You should see:

practice-laptop: reconnect.

Its old unwanted route should remain blocked:

seclab probe demo-upload

You should see:

practice-laptop -> parcel-cache:443
Blocked: process_stopped

Here the source process is stopped. The block now comes from cleanup, rather than isolation. That distinction matters when deciding whether recovery is complete.