The attacker deleted everything. At 2 a.m., /proc still remembered.

How to recover a deleted, still-running payload straight from /proc on Linux, and why 'rm' never erases the evidence.