In your experience, are there other, more careful organizations who would have taken the host offline but saved a disk dump for later investigation?