[aidenscott2016]

>Before the former primary server could be placed into rotation, a snapshot of the server was made to ensure the backup would not delete itself upon reconnection

I don’t understand this. Was the snapshot made of the compromised database or of the old not in use one? Why would the backup (snapshot?) delete itself on reconnection?

[mackman]

My guess is they were going to attempt point in time recovery by replaying transaction or relocation log after the snapshot and stop it before the drop. Unless they made a mistake.