How to find last deleted files on OpenSuse?

Question

I didn't lock the screen on my OpenSuse Linux and let my girlfriend do all evil things when I was sleeping. Is there a way to find out if she deleted any files from my PC?

I was looking at the "Date Modified" timestamp of my folders and then I tried to delete something and that date didn't change. I was also looking at logs in /var/log, but I don't know where exactly to look and also haven't found anything.

I think she deleted files by moving them to the trash can and then emptying the trash can and I think that this procedure will be in some log.

Answer 1

I don't work with OpenSuse, but as I know, there is no logs on trashcan.

But if content of a directory change, His modification time have to change too.

At all, there is a few possibility to restore something, but:

• You have to stop immediatly your disk activity (in root: mount -o remount,ro /home if /home is the mountpoint of partition)

• You have to know what you want to restore, there is a few tools for doing that job, but you have to inform them about what to search for.

• If / (root) is the partition to work on, you have to use another way, like live-usb in order to be able to work on read-only partition.

• Preferably copy whole partition to another before of working on.

Modifying Trashcan behaviour to ask him to make log is possible too, but this depend on which desktop environment you are using.

There are essentially two widely used file-manager:

• nautilus on gnome
• konqueror on kde

I use nautilus. Running gconf-editor, searching for trash (including key names), there are no log, nor empty trash command. So if you're using gnome's nautilus, there are 2 ways:

• using inotify (inotifywait) for monitoring the gnome's trash directory, than moving every new entry to a hidden directory, before empty trash could be run by user.

• patching nautilus from source for adding such a feature. (Or pay a programmer to do this) and send your modif to nautilus's maintener as a suggest.

Answer 2

I am in fact using openSUSE, but @F.Hauri is basically right.

Files, which have actually been totally deleted (from trash) are not logged. I guess you run a standard set-up, so the file-system should be something like ext3 or ext4. There are a number of tools, which can scan your file-system for the remains of deleted files, e.g. http://extundelete.sourceforge.net/ This will find a number of files, even very old stuff, in case they have not been overwritten by other files.