4

I'm working on Ubuntu 13.04. yesterday from a Windows 7 partition, I accidentally deleted many files. I deleted by pressing shift-del.

Is there any way to know the name of the files that got deleted? If I'm able to get the names, I will make out how important the files are? If they are important I will try to recover or else I won't try. With no idea on whether log files can reveal that, I checked syslog file generated for that day but I couldn't find any information regarding that.

  • There will be no information in the Linux logs if you did this from Windows. – terdon Jan 5 '14 at 14:54
3

No there isn't generally any log that is maintained that keeps track of what files were deleted. About the only thing I can think of outside of trying to undelete the files using something like this Q&A: undelete files from local fileserver, is you could take a look at your system's locate command. It keeps a full list of all the files on a system, it's typically run nightly via cron, so you might find a list of the file names there, assuming you know what directories they were in.

Example

To get a list of all the files in my $HOME directory.

$ locate /home/saml | head -5
/home/saml
/home/saml/.Fontmatrix
/home/saml/.ICEauthority
/home/saml/.Trash
/home/saml/.VirtualBox

UPDATE #1

This approach would work so long as 2 conditions are met.

  1. The Windows 7 partition was mounted during the window of time that the cronjob that runs the indexing of the HDD (typically this: /etc/cron.daily/mlocate). This task runs daily, so if the partition is mounted one day but not the next, the data for that partition will get erased.
  2. The mlocate crontab entry hasn't run yet, with those files now erased.

NOTE: This option is what I would consider a last ditch effort, something before resorting to actually attempting to recover the files using one of the many undelete methods covered on Unix & Linux. You have a very small window of opportunity to get a listing of files that were on your system from the mlocate database but have been deleted.

  • 1
    Great idea, +1! Perhaps the OP can compare the output of locate with the output of locate --existing and work from that. – terdon Jan 5 '14 at 15:59
  • @terdon - thanks, he'll have to work quickly though, I think the next time the locate cron runs the data will get lost. – slm Jan 5 '14 at 16:00
  • Yup, but that depends on the settings in /etc/cron.daily/mlocate, might even be earlier. – terdon Jan 5 '14 at 16:03
  • I ran locate /boot | head -5. If it had to output the files under /boot they why it gave outputs under /etc. For ex.: one line of output is /etc/default/bootlogd. In my case, as it was Windows partition which always needs to be mounted manually, I ran the command locate /media/ravbholua/100EECEB0EECCB34 but it returned no output. – Ravi Jan 5 '14 at 17:14
  • @Ravi - it is pattern matching "/boot" in the string "/etc/default/bootlogd". If locate found nothing then this idea though valid is a dead end since the data for /media is likely gone now. – slm Jan 5 '14 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.