Not so easy is right! And could be an argument for 'automated backups' to not only the moodledata directory, but a directory outside of Moodle.
But, there still might be a backup file of the course if the cron job hasn't moved files to trashdir and emptied the trash! :|
A query like:
select * from `mdl_files` where (`component` like "backup" and `filename` like "%.mbz%")
will show if there are any backups … automated or course.
You'll have to determine which row of data to work with by the filename column - which isn't very descriptive unless you've turned on the option to include the course name/title in the backup file names (may not be a feature in your version).
Use the contenthash information to determine the directories the hashed named backups are located in. Example: a contenthash of c20151cef6e8607f501e970be52eb48d6fe11335
cd moodledata/filedir/c2/01/
ls -l
will show a file: c20151cef6e8607f501e970be52eb48d6fe11335
To determine if that is a backup:
head -n 1 c20151cef6e8607f501e970be52eb48d6fe11335
should show PK or P on the first line.
Copy the c20151cef6e8607f501e970be52eb48d6fe11335 file out into a test directory. Do NOT move ... copy! ;)
cp c20151cef6e8607f501e970be52eb48d6fe11335 /home/test/
Change into the test directory
cd /home/test/
Rename the c20151cef6e8607f501e970be52eb48d6fe11335 file to 'abackup.zip'.
Unzip the file:
unzip abackup.zip
If you see folders/files like:
files.xml moodle_backup.log questions.xml users.xml
completion.xml gradebook.xml moodle_backup.xml roles.xml
course groups.xml outcomes.xml scales.xml
It is a backup!
To restore to a 2, change the abackup.zip file name to abackup.mbz, download the .mbz file, then attempt restore.
Best of luck!
'spirit of sharing', Ken