Introduction
If files have gone missing from a cPanel account you have the following options:
- Restore from a backup.
- Review some of the logs on the server to see if you can find clues about the issue.
- Hire a security professional to investigate a potential compromise.
- Hire a data recovery professional to attempt to recover the files.
If you want to hire a security professional to investigate the issue, do not restore a backup or make any modifications to the files on the account.
No matter what, be sure to reset the password on the account as soon as possible.
Although cPanel cannot provide security services, we would like to offer the following guide to help you get started as a courtesy.
Procedure
If you would like to attempt to review some of the logs in your own investigation you may consider checking the following:
/var/log/secure- This log contains SSH login information./var/log/messages- This log often contains FTP logs./usr/local/cpanel/logs/access_log- This contains logs relevant to File Manager and cPanel./home/cpanelusername/.bash_history- This is the user's bash history if shell access is enabled./home/cpanelusername/.lastlogin- This contains the IP addresses of recent logins for the user.
If you would like to restore a backup of the account, you can learn how to do so here: