4

Somehow some files are missing in a directory and I would like to know what happened to those files. Who has moved/deleted them? How can I investigate?

Can we get a history on a directory?

These are ordinary user files on AIX 6.1; I don't know what file system is in use.

0

3 Answers 3

6

As a brute force approach, assuming you have access to all user directories and that all users are using bash as their default shell, you could search through their history files:

grep 'deletedfilename' /home/*/.bash_history

Assuming they were deleted recently enough for the command to still be saved in the user's shell history, that will show you who deleted the files. You can also extend this to search the equivalent files of other shells. For example:

grep 'deletedfilename' /home/*/.bash_history /home/*/.zsh_history 
4
  • 1
    Does AIX have an auth.log file? If they were system files, I'd grep for mv commands there as well. Commented Jul 19, 2014 at 13:29
  • @steeldriver I'm not familiar with any unix variant where mv commands would be recorded anywhere with their arguments by default. Typically auth.log only contains records of authentications. Commented Jul 19, 2014 at 23:23
  • I meant that if elevated permissions were required (either because the files were system files, or because they were moved by someone other than the files' owner - for example using sudo or su) that might be recorded in the auth.log Commented Jul 19, 2014 at 23:39
  • This assumes the user deleted it or accessed it by filename (and not some form of wildcard "deletedfil*" ), and that the user didn't clear it from their history.
    – Mark W
    Commented Aug 22, 2018 at 13:00
2

If it's possible they were moved, try to find them with locate - that would find them if they were moved a while ago, before last run of updatedb (typically daiy):

locate --existing --basename 'foo.txt'

or using short options:

locate -eb 'foo.txt'


If that does not find them, you could use the find command.

Guess where it could be to choose a directrory to search recursively, before using find on larger directory trees.

Take care regarding remote file systems - for example, before running find /home -name foo.txt, check whether that may automount all home directories - possibly thousands, and whether you want that.

1
  • updatedb and locate are not part of a normal installation of AIX. They'd have to be installed from a third-party source. Commented Jul 19, 2014 at 23:22
2

In addition to the searches recommended by terdon, you could also search by the folder name.

So if someone deleted (or moved) the files using a wildcard, you may not find any of your filenames specified in any history file.

For example, if someone did:

$ cd /home/mydir
$ rm *
    Or
$ cd somewhere-else
$ mv /home/mydir/* .

You wouldn't find any of your filenames in their history, but you would find mydir.

So, also try:

grep 'mydir' /home/*/.bash_history /home/*/.zsh_history 


Also: I don't know if it's possible, but perhaps this happened as a result of some automated cleanup after exceeding disk-quota. That would be a pretty brutal policy, but I suppose it's possible and it might be worth investigating.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .