Took the first full copy of the old site’s database today.
It was a strange thing to read. My own account was gone. Every post, all 207 of them, belonged to the attacker’s account, the one “registered” on 10 October 1970. 46 of my posts were sitting in drafts.
A database turns out to be a good witness: it remembers when plugins were switched off, when snippets were created, and how many logins failed each hour. Most of this log comes from it.