Perhaps. I would ask the customer and take their direction. I assume as a freelancer, you're being paid by the hour/day, so it doesn't matter what is asked of you.

Great analysis, but the wrong solution.

You don't know how deep that hacker's rabbit hole goes, so you should have simply recovered/backedup the user's data, configuration files, etc, and filled the rabbit hole with cement — the format and reinstall the OS kind of cement.

Cool story though.