Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My Ubuntu server has about roughly 30 active users on it. I personally know everyone using the server. Recently, a few friends and I were working on project. We made a new directory for the project and since everyone knows everyone we didn't bother protecting our work under a bunch of permissions. We should have though, because we woke up this morning to find that someone removed our entire directory.

Our work is backed up every night so it's really not a big deal to restore our work. However, we would like to find out who removed it so we can confront them. So far the best thing we've come up with for finding our culprit is checking everyone's bash history but this is long and tedious and chances are that if there was a malicious intent behind the directory removal that our culprit probably modified theirs to cover their tracks (or of course they might use a different shell).

So, basically, what is the easiest and quickest way to find out who deleted a directory?

Thanks in advance for your time.

share|improve this question
I don't think it is possible. – enzotib Jun 20 '11 at 14:46
Next time use a version control system or SparkleShare (which uses a the VCS git) or an encrypted folder (using [gnome-]encfs) synchronized with Ubuntu One or Dropbox. – dAnjou Jun 20 '11 at 16:10
@dAnjou We do have git and subversion installed on our server but since we working on a website which we were constantly adding/removing files from it seemed like an unneeded hassle to bother with using either. As I alluded in my question, we probably should have made a group and made the directory only accessible by our group. Regardless, we can get all our work back since we backed it up. My concern right now is that I don't want a user deleting directories on the system that they are unaffiliated with. I trust all my users not to do something like this so this really bothers me. – Rob S. Jun 20 '11 at 17:10
Yep, not possible. – psusi Jun 20 '11 at 17:46
You can watch for deletions (or modification) to files. See… and man auditctl – Lekensteyn Jun 20 '11 at 21:24
up vote 5 down vote accepted

I didn't find a magic bullet answer to your question; part of that reason is detailed here:

This simple command may help you track down what happened, searching for rm & mv commands in all shell history files in all users home directories:

find /home -type f -iname .*history -exec grep "rm\|mv" {} \;

It's good you have a valid backup to save you, but I highly recommend creating some groups for project folders and just adding user accounts to those groups; that will save you a lot of pain in the future.

Example: add a group and add project team members to it

groupadd coolproject
adduser jim coolproject
adduser joe coolproject
adduser charlie coolproject

set the permissions properly recursively and guarantee access going forward for the team regardless of who creates/edits files

chown -R yourusername:coolproject /path/to/projectdir
find /path/to/projectdir -type d -exec chmod 2775 {} \;

(the 2 sets the group ownership to "sticky" this makes sure the group owner of any projects remains "coolproject")

find /path/to/projectdir -type f -exec chmod 664 {} \;

Hope that helps ya out! B-)

share|improve this answer
Thanks! I modified your command to " find /home -type f -iname .*history -print -exec grep "rm\|mv" {} \; " so I could get the file names of the histories that turned up interesting info. – Rob S. Jun 20 '11 at 20:06
excellent Rob! glad i could be of some help. =) – Chad Stovern Jun 21 '11 at 15:48

In theory it is possible to find out the delete time, so this can narrow the users down.

Check the i_dtime in ext2 specs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.