Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Somehow some files are missing in a directory and I would like to know what happened to those files. Who has moved/deleted them? How can I investigate?
Can we get a history on a directory?
These are ordinary user files on AIX 6.1; I don't know what file system is in use.
As a brute force approach, assuming you have access to all user directories and that all users are using bash as their default shell, you could search through their history files:
grep 'deletedfilename' /home/*/.bash_history
Assuming they were deleted recently enough for the command to still be saved in the user's shell history, that will show you who deleted the files. You can also extend this to search the equivalent files of other shells. For example:
grep 'deletedfilename' /home/*/.bash_history /home/*/.zsh_history
mv commands would be recorded anywhere with their arguments by default. Typically auth.log only contains records of authentications.
Jul 19, 2014 at 23:23
sudo or su) that might be recorded in the auth.log
Jul 19, 2014 at 23:39
If it's possible they were moved, try to find them with locate - that would find them if they were moved a while ago, before last run of updatedb (typically daiy):
locate --existing --basename 'foo.txt'
or using short options:
locate -eb 'foo.txt'
If that does not find them, you could use the find command.
Guess where it could be to choose a directrory to search recursively, before using find on larger directory trees.
Take care regarding remote file systems - for example, before running find /home -name foo.txt, check whether that may automount all home directories - possibly thousands, and whether you want that.
updatedb and locate are not part of a normal installation of AIX. They'd have to be installed from a third-party source.
Jul 19, 2014 at 23:22
In addition to the searches recommended by terdon, you could also search by the folder name.
So if someone deleted (or moved) the files using a wildcard, you may not find any of your filenames specified in any history file.
For example, if someone did:
$ cd /home/mydir
$ rm *
Or
$ cd somewhere-else
$ mv /home/mydir/* .
You wouldn't find any of your filenames in their history, but you would find mydir.
So, also try:
grep 'mydir' /home/*/.bash_history /home/*/.zsh_history
Also: I don't know if it's possible, but perhaps this happened as a result of some automated cleanup after exceeding disk-quota. That would be a pretty brutal policy, but I suppose it's possible and it might be worth investigating.
