Question
A client just contacted me saying they've accidentally removed a domain, and they'd like it restored from backups. How can I determine which account the domain belonged to?
Answer
There are a few ways to determine which account owned a domain, depending on whether they removed only the domain or if they removed the entire account that owned the domain.
If it was just an addon/parked domain that got removed, you could most easily find the account by looking for the domain in the /var/cpanel/users/ files:
grep -R $DOMAIN /var/cpanel/users/
Domains removed from an account will appear in these files as "XDNS=$DOMAIN" to indicate that it is a former (X) DNS entry for the account.
If this returns no results at all, it is likely that they actually removed the entire account and not just the domain. If the domain in question was the main (or only) domain associated with the account, then you can find this in the /var/cpanel/accounting.log file:
grep $DOMAIN /var/cpanel/accounting.log
You should find a "REMOVE" entry showing the domain. The very last field of this colon-separated entry will be the username of the account which was terminated.