The Last Known-Good State Is a Decision

Teams speak of the last known-good state as if it were a timestamp waiting to be discovered.

Good for what? The data may be complete while an administrator was already compromised. The system may be clean while missing essential transactions. A backup date is evidence, not a decision.

Balance three losses

- Security loss from restoring hostile persistence.

- Business loss from discarding valid activity.

- Evidential loss from overwriting the period that explains the incident.

Value object — The Recovery-Point Decision Record

- Candidate state and evidence.

- Known compromise window.

- Business transactions lost.

- Reconciliation plan.

- Decision authority.

- Monitoring and rollback.

Restore in controlled rings

Bring back identity, observation and essential records before broad connectivity. Reconcile lost activity from independent sources.

The last known-good state is the state the institution can defend as trustworthy enough for the next controlled action.

Where this breaks

The phrase known-good often reflects confidence rather than evidence. Choosing the newest backup protects productivity; choosing the oldest protects against persistence; neither automatically protects the institution.

The operating move

Make the trade-off explicit. Use forensic evidence, business records and recovery tests to select a state, then plan reconciliation for what is intentionally discarded.

Document the compromise window.

Quantify valid activity lost.

Reissue privileged credentials.

Monitor the restored ring.

The test

Present two plausible recovery points to the incident authority. If the team cannot explain the consequence of each, the choice is still technical guesswork.