Accidentally a rm -rf command was launched to my root directory instead of current directory. I stopped file removing by Ctrl+C but some files has already been removed. Is there a LINUX command to list all recently removed files from the system to get the affected applications ?

Operating System: CentOS 6.3

  • 2
    You should compare the current list of files with the same list of your backup medium. – Anthon Apr 29 '14 at 5:45
  • What does "my root directory" mean? Are you referring to your home directory or to the system root directory? – John1024 Apr 29 '14 at 5:55
  • Multi-site-post: stackoverflow.com/questions/23356096/… – Anthon Apr 29 '14 at 5:55
  • 2
    @Anthon, That one also posted by me and MikeW asked me to post on this Linux & Unix forum. Old one is put on hold as off-topic. – Dig The Code Apr 29 '14 at 6:19
  • @John1024 it is system's root directory (It happen accidentally) – Dig The Code Apr 30 '14 at 5:09

*nix systems typically have a locate utility installed. It has a database, usually updated nightly, that has the names of (almost) all files on your system. Just run:

locate /path/to/dir/of/interest

and you should see a list of files that were in that directory as of the last database update. You can diff this against the current list.

Because it will be overwritten automatically with a new version, you might make a back-up copy of that database now. On debian-influenced systems, it is stored in /var/lib/mlocate/mlocate.db.

How to show missing files

  1. Make a backup of the old database:

    cp /var/lib/mlocate/mlocate.db ~/old.db
  2. Update the database. The command to do this may vary. On a debian-like system, try:

    sudo /etc/cron.daily/mlocate
  3. Get the new and old file lists for your directory:

    locate -d ~/old.db /your/dir | sort >~/old.list
    locate /your/dir | sort >~/new.list
  4. Get a list of all new and missing files:

    diff ~/old.list ~/new.list

Additional notes

  • Not all files are listed in locate's database. A configuration file, typically /etc/updatedb.conf, determines which files and directories are excluded.

  • In the past I have used some version of locate that, by default, would only list files that still exist. If that is the case for your locate, you will want to turn that feature off.

  • I could check with locate command and using my backup system to compare the lists. I already found some effected applications. Thanks. – Dig The Code Apr 29 '14 at 6:08

For arch I was afraid I accidentally deleted lots of files with a bad fin ... | xargs rm -rf command format. John1024 thank you for the advice.

To simplify everything (for my web-directory /srv/http) I run this all in one line:

sudo cp /var/lib/mlocate/mlocate.db ~/old.db; sudo updatedb; sudo locate -d ~/old.db /srv/http | sort >~/old.list; sudo locate /srv/http | sort >~/new.list; sudo diff ~/old.list ~/new.list;

Make sure you replace /srv/http with your directory of concern.

and this displays the files that were changed. Thanks again!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.