post-attack recovery