Where did my rsync'd files go? Could they have been redirected by a hacked machine?

Question

Today a colleague was told to reformat their Ubuntu 10.04 drive since someone had hacked the root user password.

So, I attached my backup drive and did

sudo rsync -routi /home/user /media/backup/
sudo rsync -routi /usr/local /media/backup/
sudo rsync -routi /etc /media/backup/

Rsync took a long time on the home directory, and the output indicated that the files were being copied to the correct location on the backup drive, although I did not confirm this after the rsync by listing the files in the backup directory.

They then did a fresh reinstall of Ubuntu. However, now, I can not find the files that I had rsynced, although no work was lost since the /home/user/work directory had been backed up daily.

Can anyone help me figure out where these files might have gone? Is it possible that this is related to the fact that the system's security had been compromised?

Answer 1

If they had just erased the files they might be recoverable. After a reinstall of Ubuntu the chances are very near zero that you'll be able to get anything recovered.

Instead I'd take another look at /media/backup and try to find them there. try something like:

find /media/backup -type d -name your_home_directory

I'm not sure why you'd need to restore /etc or /usr/local but you can use find for these as well.