Rescue manifest generated UTC: Fri May  8 12:38:37 UTC 2026
Host: rescue
Mounted original root: /mnt

Disk:
Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/sda2      ext4  196G  174G   13G  94% /mnt

Key rescue output:
- rescue-restore-metadata-20260508.tar.gz: focused cPanel restore metadata, cron copies, manifests, and notes.
- cpanel-configs-etc-varcpanel-20260508.tar.gz: Apache/MySQL/cPanel configuration subset.
- manifests/cpanel-home-accounts.txt: cPanel accounts found under /home.
- manifests/mysql-databases.txt: MySQL datadir database names.
- manifests/domain-docroots.txt: cPanel domain/docroot mapping extracted from userdata.
- notes/startup-cron-suspicious.txt: suspicious cron/startup evidence.
- notes/neutralized-malware.txt: persistence disabled on the mounted OS.

Primary data still to copy off-host:
- /mnt/home
- /mnt/var/lib/mysql
- /mnt/root/rescue-20260508

Suggested transfer from rescue system to a clean backup host:
rsync -aHAX --numeric-ids --info=progress2 /mnt/root/rescue-20260508/ user@BACKUP_HOST:/backup/rescue-20260508/
rsync -aHAX --numeric-ids --info=progress2 /mnt/var/lib/mysql/ user@BACKUP_HOST:/backup/mysql-raw/
rsync -aHAX --numeric-ids --info=progress2 /mnt/home/ user@BACKUP_HOST:/backup/home/