Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Somehow some files are missing in a directory and I would like to know what happened to those files. Who has moved/deleted them? How can I investigate?

Can we get a history on a directory?

These are ordinary user files on AIX 6.1; I don't know what file system is in use.

share|improve this question

3 Answers 3

As a brute force approach, assuming you have access to all user directories and that all users are using bash as their default shell, you could search through their history files:

grep 'deletedfilename' /home/*/.bash_history

Assuming they were deleted recently enough for the command to still be saved in the user's shell history, that will show you who deleted the files. You can also extend this to search the equivalent files of other shells. For example:

grep 'deletedfilename' /home/*/.bash_history /home/*/.zsh_history 
share|improve this answer
1  
Does AIX have an auth.log file? If they were system files, I'd grep for mv commands there as well. –  steeldriver Jul 19 at 13:29
    
@steeldriver I'm not familiar with any unix variant where mv commands would be recorded anywhere with their arguments by default. Typically auth.log only contains records of authentications. –  Gilles Jul 19 at 23:23
    
I meant that if elevated permissions were required (either because the files were system files, or because they were moved by someone other than the files' owner - for example using sudo or su) that might be recorded in the auth.log –  steeldriver Jul 19 at 23:39

If it's possible they were moved, try to find them with locate - that would find them if they were moved a while ago, before last run of updatedb (typically daiy):

locate --existing --basename 'foo.txt'

or using short options:

locate -eb 'foo.txt'


If that does not find them, you could use the find command.

Guess where it could be to choose a directrory to search recursively, before using find on larger directory trees.

Take care regarding remote file systems - for example, before running find /home -name foo.txt, check whether that may automount all home directories - possibly thousands, and whether you want that.

share|improve this answer
    
updatedb and locate are not part of a normal installation of AIX. They'd have to be installed from a third-party source. –  Gilles Jul 19 at 23:22

In addition to the searches recommended by terdon, you could also search by the folder name.

So if someone deleted (or moved) the files using a wildcard, you may not find any of your filenames specified in any history file.

For example, if someone did:

$ cd /home/mydir
$ rm *
    Or
$ cd somewhere-else
$ mv /home/mydir/* .

You wouldn't find any of your filenames in their history, but you would find mydir.

So, also try:

grep 'mydir' /home/*/.bash_history /home/*/.zsh_history 


Also: I don't know if it's possible, but perhaps this happened as a result of some automated cleanup after exceeding disk-quota. That would be a pretty brutal policy, but I suppose it's possible and it might be worth investigating.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.