[fauria]

The attacker could have used a script like this:

  use foobar
  db.collection.find()
  db.dropDatabase()

and then:

  cat script.js | mongo | tee backup

so there is indeed a plausible way to backup the database before dropping it. The timestamps seems to be as well plausible for a small database.