Is it Possible to know when files were deleted?

Question

Is it possible to know that?,like when were they deleted, by which user, etc; or is any information regarding the files completely erased

Answer 1

If by delete, you mean "moved to the trash bin", yes and no. You'll always know who moved the file to the trash, because it'll end up in their trash bin. You won't know when it was moved to the trash, because move operations don't update the file's timestamp.

If by delete, you mean rm or "Empty trash", no. The ext2/3/4 file systems don't intend undeletion as a feature, and so don't store meta info like you're looking for.

Of course, if you perform regular backups, you can extrapolate a time window for the deletion.

Answer 2

If you are interested a particular file or directory inotifywait can be used but it won't tell you who did it. Also, the notifications will not distinguish between an ordinary write to a file and filling the file with junk or truncating it.

For example:

$ inotifywait -q /var/tmp/junk & sleep 2; touch /var/tmp/junk
/var/tmp/junk OPEN 
$ inotifywait -q /var/tmp/junk & sleep 2; cat /etc/hosts > /var/tmp/junk
/var/tmp/junk MODIFY 
$ inotifywait -q /var/tmp/junk & sleep 2; cat /dev/null > /var/tmp/junk
/var/tmp/junk MODIFY 
$ inotifywait -q /var/tmp/junk & sleep 2; rm /var/tmp/junk
/var/tmp/junk ATTRIB

Note that without inotify's --monitor option, even the rm command only shows up as an ATTRIB action because rm first checks permissions on the file.

This is probably not even close to what you are looking for, but it may be of use. The comparison to backups suggested by djeikyb will give you far more detailed information.