I've been trying to get all the data off the drives on the machine which
was broken into. I have a feeling that whoever this was was hiding stuff
in the file system because both drives will not fsck clean nor will they
completely read.
I've managed to get most of the data off but not all. Given that I've put
about 3 days into this I'm pretty much done. If someone else wants to look
at the drives I can make them available, let me know. But just reading the
main drive makes the kernel (Fedora 1) kill the tar process as below (it
also managed to wack the system enough that it overwrote the NVRAM with
garbage). It hasn't been a fun weekend.