I had Duplicati setup on an UBUNTU system to essentially backup a VM. The VM content is fairly static, but reproducible, so this was pre-empting going into a more production-like phase when it would be critical that the backups are performed. The VM is around 200Gb.
One of my ‘team’ has been dicking about on the UBUNTU system. Duplicati wasn’t working. I suspect he screwed something up. That’s not the issue, I can get it working again.
What is the issue is that when I went to the backup source (in Dropbox setup as: Apps/EmpyreanServer) the folder was empty. Now I know there was content, because I checked it several times and checked dates to ensure that the incremental backups were working, and they were.
So my question (and maybe a Dropbox thing, but I don’t think so, I have content in Dropbox going back several years):
Would Duplicati, for whatever reason, have deleted the entire backup data for several weeks and representing many Gb of data both being backed up and in the backup itself, ie. I KNOW the backup location had Many Gb of data. My Dropbox plan was 1Tb and has been increased to 2Tb so that would not be an issue, but even if the repository was full, all of the data should not have been deleted.
I turned ‘show deleted files’ ON, but nothing which is in and of itself strange. I feel like I’m in an alternate universe:)
Of course, I could have been hacked, but it seems odd that ONLY the Duplicati backup was removed.
So doing some forensics this side, if you have any idea/suggestions please let me know.
I recall at the time, about a month ago, I’d built (and rebuilt several times) a new Ryzen system with a 1 Tb SSD that was somewhat problematic. We replaced the SSD eventually.
It is possible that in a peak of frustration the Duplicati stuff was installed and never cranked up (after deleting the original Dropbox backup location and creating a new location which would explain why ‘Show Deleted Files’ shows no deleted files). This is unlikely, but I do recall a high degree of frustration at the time.
Occam’s Razor, let’s go with that…
Of course if there are any other explanations, I’d be happy to hear.
The best I can do is to help approximate a time of disappearance, and get evidence it’s not Duplicati. Since a location change was mentioned, possibly Dropbox search could discover another set of files. Someone who has Dropbox might have other ideas.
This assumes the old DB is still around. When did jobs run and when did they start missing the files? Backup also has Show log → Remote that should show remote deletions and other remote activities. Clicking on a list will show what files were seen on the remote at the time shown on that report line.
Duplicati should refuse to delete the last backup even given misconfigurations of retention unless you also set Advanced option –allow-full-removal=true. You have to work hard to do full remote deletion…
Thanks, I’ve had a look and there appears to be nothing so there is a fair likelihood I rebuilt the UBUNTU system installed and configured Duplicati and didn’t start a backup (which doesn’t quite make sense). Regardless, as others continue to remind me, if a choice between conspiracy and incompetence, pick incompetence every time.
I have started a backup based on the criteria established previously. It’s about 400Gb so that will take some time to pump up to Dropbox. I’'l then look to keeping somewhat close tabs on the backups.
Again, thanks for the advice, I’ve marked it as the solution because essentially what you suggest is about all that can or could be done.