I have a customer who hosts an extremely LARGE online game. Anywho, someone, somehow guessed his accounts password and deleted the entire "public_html" directory along with all DB's and their relative contents. Now I was taking DAILY backups of all accounts yet when I use the backup restore function.. it set's the account back up but WITHOUT the DB's and the files inside of his account (it sets the thing up as if it were a brand new account). I selected to restore the DB, subdomains.. the lot.. anyone know what could be wrong? Did this intruder SOMEHOW manage to modify the contents of the backup?!

What program/script are you using to backup and restore? Have you ever tested it to besure it works?

If the backups were somehow tampered with; it was /root/ that was hacked.

Where are the backups kept, they should never be on the same server...

It is all run by cpanel - all is ok now.. it turned out to be suexec that was the problem.. I turned it off.. all cgi scripts worked and it actually restored.. I tell yah.. what good is suexec?!

I am glad everything worked out for you!