After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords".
After a possible intrusion how do you know what the hacker did in your server?
Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.Sign up to join this community
Security Stack Exchange has a range of Questions and Answers in this area - you should have a look.
While post-incident forensics is quite a mature field, and I have managed a number of these, it is high cost, and most organisations take the sensible view of assuming worst case - the attacker could have accessed everything. A usual tack is to wipe machines and revert to a backup taken before the incident - but this can be very expensive in a large enterprise.
In terms of likelihood of identifying activities, if you are logging at the perimeter you can often find out how the attacker got in, but after that point, if they set up an SSH server or other encrypted channel into your network you will lose the detail after that.
For individual servers, you may have logs which can be trawled through (very time consuming) but if the attacker got root on these machines they could alter the logs to hide any evidence - which is why it is always recommended to log to a machine elsewhere which has a write once, read many filesystem (which means anything written there can never be deleted)
Layers of security do help in not only preventing intrusion, but in detecting it before it becomes a 'lift off and nuke from orbit' scenario.
As an interesting aside - many times when running a forensic analysis after an incident, teams find evidence of other, longer-term, well-hidden intrusions...worried, anyone?
Hopefully their activity is logged and you can analyze what they have done. Otherwise, without any sort of trace of their activity, it's hard to determine what could have been done. I would always assume the worst, but hope for the best. Usually companies report the worst case intrusion to alert their customers to what may have been compromised.