Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is it possible to know that?,like when were they deleted, by which user, etc; or is any information regarding the files completely erased

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

If by delete, you mean "moved to the trash bin", yes and no. You'll always know who moved the file to the trash, because it'll end up in their trash bin. You won't know when it was moved to the trash, because move operations don't update the file's timestamp.

If by delete, you mean rm or "Empty trash", no. The ext2/3/4 file systems don't intend undeletion as a feature, and so don't store meta info like you're looking for.

Of course, if you perform regular backups, you can extrapolate a time window for the deletion.

share|improve this answer
add comment

If you are interested a particular file or directory inotifywait can be used but it won't tell you who did it. Also, the notifications will not distinguish between an ordinary write to a file and filling the file with junk or truncating it.

For example:

$ inotifywait -q /var/tmp/junk & sleep 2; touch /var/tmp/junk
/var/tmp/junk OPEN 
$ inotifywait -q /var/tmp/junk & sleep 2; cat /etc/hosts > /var/tmp/junk
/var/tmp/junk MODIFY 
$ inotifywait -q /var/tmp/junk & sleep 2; cat /dev/null > /var/tmp/junk
/var/tmp/junk MODIFY 
$ inotifywait -q /var/tmp/junk & sleep 2; rm /var/tmp/junk
/var/tmp/junk ATTRIB

Note that without inotify's --monitor option, even the rm command only shows up as an ATTRIB action because rm first checks permissions on the file.

This is probably not even close to what you are looking for, but it may be of use. The comparison to backups suggested by djeikyb will give you far more detailed information.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.