Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today a colleague was told to reformat their Ubuntu 10.04 drive since someone had hacked the root user password.

So, I attached my backup drive and did

sudo rsync -routi /home/user /media/backup/
sudo rsync -routi /usr/local /media/backup/
sudo rsync -routi /etc /media/backup/

Rsync took a long time on the home directory, and the output indicated that the files were being copied to the correct location on the backup drive, although I did not confirm this after the rsync by listing the files in the backup directory.

They then did a fresh reinstall of Ubuntu. However, now, I can not find the files that I had rsynced, although no work was lost since the /home/user/work directory had been backed up daily.

Can anyone help me figure out where these files might have gone? Is it possible that this is related to the fact that the system's security had been compromised?

share|improve this question
up vote 1 down vote accepted

If they had just erased the files they might be recoverable. After a reinstall of Ubuntu the chances are very near zero that you'll be able to get anything recovered.

Instead I'd take another look at /media/backup and try to find them there. try something like:

find /media/backup -type d -name your_home_directory

I'm not sure why you'd need to restore /etc or /usr/local but you can use find for these as well.

share|improve this answer
I will try find tomorrow and let you know. I backed up /etc as recommended by the sys admin and /usr/local as recommended elsewhere (…) – David LeBauer Nov 2 '10 at 1:51
I can see backing up /etc and /usr/local for your own machine, not sure why it's required for you to back up your colleague's... but if it makes sense to you then by all means do it. – hotei Nov 2 '10 at 4:04
find didn't work, but thanks for the suggestion. I am trying to help my colleague get back up and running, so I am doing the same for him as I would for myself. – David LeBauer Nov 2 '10 at 14:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .