Hi,
One of my customers had an incident that the flashs of the core switch, HQ WAN router and all the branches' routers were formatted and the images were deleted at the same day!
We are restoring his network and investigating into the situation. The customer is suspecting that somebody has logged in and did that intentionally.
My question is, can we retrieve the logs from a formatted flash? And the second part of the question is, if the logs were retrieved can we get any clue from the logs?
Unfortuantely, the customer doesnt have any security solutions in place that could guide us!
Regards,
Haitham
