What version of Moodle?
Are you sure backups still reside in moodledata/filedir/
select contenthash,filename,component,filearea from `mdl_files` where (`component` like "backup" and `filearea` like "automated")
+------------------------------------------+----------+-----------+-----------+
| contenthash | filename | component | filearea |
+------------------------------------------+----------+-----------+-----------+
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | automated |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | automated |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | automated |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | automated |
Note that all the contenthashes are exactly the same .... below you'll see why.
Then from command line ...
cd /path/to/moodledata/filedir/
Find for file by contenthash:
[root@sos filedir]# find ./ -name da39a3ee5e6b4b0d3255bfef95601890afd80709
./da/39/da39a3ee5e6b4b0d3255bfef95601890afd80709
Check for file info:
[root@sos filedir]# file -b ./da/39/da39a3ee5e6b4b0d3255bfef95601890afd80709
empty
note is says empty.
checking that:
[root@sos filedir]# ls -l ./da/39/da39a3ee5e6b4b0d3255bfef95601890afd80709
-rw-rw-rw-. 1 apache apache 0 Nov 17 2017 ./da/39/da39a3ee5e6b4b0d3255bfef95601890afd80709
shows 0 bytes.
It's a place holder, so to speak.
Those are automated backups that are working as expected.
select contenthash,filename,component,filearea from `mdl_files` where `component` like "backup";
+------------------------------------------+----------+-----------+-----------+
| contenthash | filename | component | filearea |
+------------------------------------------+----------+-----------+-----------+
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | automated |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | automated |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | automated |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | automated |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | course |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | course |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | course |
| da39a3ee5e6b4b0d3255bfef95601890afd80709 | . | backup | course |
+------------------------------------------+----------+-----------+-----------+
If backups were made by other means, filenames would not be a '.' but something like
backup-moodle2-course-3-mshare-20180701-1938.mbz
IF you find other backup files in moodledata/filedir/ could they be backups made by teacher?
'spirit of sharing', Ken