9 seconds to delete a production database: what the pocketos incident reveals about recovery