I haven’t done any extensive looking at his situation specifically, but your link is more confusing than clarifying. He originally said his access was revoked and all his data deleted, but in your linked post it says his access to was revoked, but his server is still running. Is he saying that his VM still exists, the OS still running, but someone logged into the OS and specifically deleted all of his data leaving the server intact? That doesn’t sound likely, so I don’t understand what his situation is.