Cracking as I have explained just now are made simple. Cracking has been made simple. There are various ways of tracking a cracker or a hacker. However, often times, a hacker would have done a better job at removing their traces than a cracker. In tracking such activities, care must be given to preservation of evidence to ensure that no evidences are lost or tampered with.
Recovery is possible if dealt with care.
MyCERT had dealt with incidents in which action taken by the administrator was slow and careless, thus causing more damage to their system when the crackers find that their activities are known. The period of recovery depends on the resources available. In handling incidents involving intrusions, there are two options on methods of response. One is to disconnect and prosecute, which basically means disconnecting the target host from the network and analyze the traces for possible prosecution and recover the services immediately through machine replacement. The second option is to continue and track the intruder, by allowing the intruder to continuously use the system, in which the important data are already being backed up and the system compromised is a decoy.