有人进入我的serwer并运行mongodb中的所有数据库。 从mongodb的日志我发现命令：
Thu Jan 5 01:44:46.439 [initandlisten] connection accepted from 95.211.184.210:38159 #547644 (98 connections now open)
Thu Jan 5 01:44:46.576 [conn547644] dropDatabase local starting Thu Jan 5 01:44:46.578 [conn547644] removeJournalFiles
Thu Jan 5 01:44:46.584 [conn547644] dropDatabase local finished
Thu Jan 5 01:44:46.601 [conn547644] dropDatabase xxxx0 starting
Thu Jan 5 01:44:46.601 [conn547644] removeJournalFiles
Thu Jan 5 01:44:46.616 [conn547644] dropDatabase xxxx0 finished
Thu Jan 5 01:44:46.633 [conn547644] dropDatabase xxxx1 starting
Thu Jan 5 01:44:46.633 [conn547644] removeJournalFiles
Thu Jan 5 01:44:46.844 [conn547644] dropDatabase xxxx1 finished
Thu Jan 5 01:44:46.844 [conn547644] command xxxx1.$cmd command: { dropDatabase: 1.0 } ntoreturn:1 keyUpdates:0 locks(micros) W:211545 reslen:62 211ms
Thu Jan 5 01:44:46.861 [conn547644] dropDatabase xxxx2 starting
Thu Jan 5 01:44:46.861 [conn547644] removeJournalFiles
Thu Jan 5 01:44:46.883 [conn547644] dropDatabase xxxx2 finished
Thu Jan 5 01:44:46.900 [conn547644] dropDatabase xxxx3 starting
Thu Jan 5 01:44:46.900 [conn547644] removeJournalFiles
Thu Jan 5 01:44:46.919 [conn547644] dropDatabase xxxx3 finished
Thu Jan 5 01:44:46.936 [conn547644] dropDatabase xxxx4 starting
Thu Jan 5 01:44:46.936 [conn547644] removeJournalFiles
Thu Jan 5 01:44:46.939 [conn547644] dropDatabase xxxx4 finished
Thu Jan 5 01:44:46.995 [FileAllocator] allocating new datafile /data/mongodb/WARNING.ns, filling with zeroes...
Thu Jan 5 01:44:46.998 [FileAllocator] done allocating datafile /data/mongodb/WARNING.ns, size: 16MB, took 0.002 secs
Thu Jan 5 01:44:46.998 [FileAllocator] allocating new datafile /data/mongodb/WARNING.0, filling with zeroes...
Thu Jan 5 01:44:47.000 [FileAllocator] done allocating datafile /data/mongodb/WARNING.0, size: 64MB, took 0.001 secs
Thu Jan 5 01:44:47.000 [FileAllocator] allocating new datafile /data/mongodb/WARNING.1, filling with zeroes...
Thu Jan 5 01:44:47.002 [conn547644] build index WARNING.WARNING { _id: 1 }
Thu Jan 5 01:44:47.002 [FileAllocator] done allocating datafile /data/mongodb/WARNING.1, size: 128MB, took 0.002 secs
Thu Jan 5 01:44:47.002 [conn547644] build index done. scanned 0 total records. 0 secs
Thu Jan 5 01:44:47.056 [conn547644] end connection 95.211.184.210:38159 (97 connections now open)
我只有IP和conn号码。 Ip看起来像来自荷兰（我认为有人使用代理假冒这种连接）。有没有办法找到有关该用户547644的更多详细信息？也许他登录系统的关键是什么？也许有一些方法可以从数据库中恢复已删除的文件？