Well, it looks like my server's been hacked. Nearly all of the main web site's files were deleted, and all the mysql files are gone. I went through the security logs to find the intrusions, plus there's two new folders in my FTP. One to delete files, and one to check passwords. So definitely a hacking, and not just a directory that needs to be repaired or anything like that

The problem is that two backup methods in a row stopped working on me, so the last update is very old, and the database structure has changed dramatically since then. I've been trying to find out a way to recover the files, but I barely know anything about Linux. I have a friend helping me out who knows a lot more, but he doesn't know too much about the operations related to recovering files either.

I've been trying to do a lot of research myself, but everything's just giving me such a headache. I found this tutorial on recovering files: recover.sourceforge.net/unix/ But I'm trying to find out more about it, it's kind of confusing there, and not specific enough compared to the large amount of files in the partition. Could anyone offer me some advice or help me out? It would be a shame for the site to die, it was a family based entertainment site with over two hundred thousand members, it made a lot of kids happy, but it was free to be a part of so I can't hire expensive companies to recover my software, and I can't take much time off of my work to redo it.

What file system are you using?

I hope you are not using the drive or you remount it as read-only as soon as possible. Before any recovery, always make an image of the partition. You can put it on another partition from another drive as file or just pipe to another drive. Use `dd if=/dev/hdc of=/mnt/recoverydrv/stupiduser.idiot bs=512 conv=sync,noerrors`. The device /dev/hdc is just an example so plug in your device in place of /dev/hdc. After it is done, you can use grep. Never use the source drive. You can also use a hex editor to help you retrieve binary files. Using both grep and a hexeditor takes a lot of knowledge and time to sort through the mess. You are going to have slim to fat chance recoverying the files.

http://www.newsforge.com/article.pl?.../10/08/1416248

I'm sure that you ran web, ftp, and mySQL server as root with out knowing it. Its best to set them up to run by a user. A user has limited permission. If someone got in through one of the servers, they will have limited function with the rm utility. To safe guard to the next intruder runs the rm command, use the techinques that is describe in the link above. Its best to setup web and ftp servers so it creates a virtual directory tree.

I suggest looking for a local data recovery service, so you do not have to ship your drive to timbuktu.

All I can say is you are just SCREWD.

Next time setup a better backup scheme and schedule. Try using a firewire drive to be used as backups if do not have enough money to get a tape drive. Run file monitor to check for any inconspicous file creation. Run a rootkit scanner. Use nessus to find if there any backdoors or flaws. Run a program that checks each file to have a certain permission. Always check for upgrades for services that provides people to access your system.

Sorry, someone reported this post to be closed but also reported the other post to be closed, so both were closed. I reopened this one at this time.