When Moodle deletes a course it also deletes the database record containing the name of the file containing the automated backup. This is how you find that file.
- Find the deletion record in the log. You are looking for a "Delete" activity done by whatever user deleted the course.
- Note the date and time the deletion took place.
- Go to [your file path]/moodledata/trashdir/. List the files and their dates modified (ls -laht in Linux/Unix).
- The folder containing your backup will have the a date modified that matches the deletion time from the log.
- cd into that folder. cd into whatever folder is in that folder (it will have a two character name, it doesn't matter what it is).
- Inside that folder should be a file with a sixteen character file name. Copy that file out of trashdir. Rename it [somename].zip
- Unzip [somename].zip (the command is "unzip [somename].zip")
- unzip acoursebackup.zip
- Quoting from recovery of accidentally deleted courses (v.2.2.6):
If you see files/folders like:
course gradebook.xml moodle_backup.xml roles.xml users.xml
activities files groups.xml outcomes.xml scales.xml
completion.xml files.xml moodle_backup.log questions.xml sections
It's a backup! ;)
To see the course name:
head -n 4 moodle_backup.xml
will show:
<?xml version="1.0" encoding="UTF-8"?>
<moodle_backup>
<information>
<name>backup-moodle2-course-testmobile-20121003-0812.mbz</name> - Your zipped file is your backup, possibly suitable for restoring. I had to download the zip file in order to use it for restoring, and my FTP program insisted on downloading the unzipped folder instead of the zipped file. To create a restorable ZIP file, I had to compress (zip) the files, NOT the folder containing the files.