I have executed rm -f *.gz about 30 days ago. Is there any way to find out the list of files that were deleted?

  • How often do you run updatedb ? Do you have backups ? – DarkHeart Jun 28 '16 at 5:10
  • @DarkHeart updatedb runs everyday and; no, there are no backups. – Cartwig Jun 28 '16 at 5:18

You can use the debugfs utility,

debugfs is a simple to use RAM-based file system specially designed for debugging purposes

First, run debugfs /dev/sda2 in your terminal (replacing /dev/sda2 with your own partition).

Once in debug mode, you can use the command lsdel to list inodes corresponding with deleted files.

When files are removed in linux they are only un-linked but their inodes (addresses in the disk where the file is actually present) are not removed

To get paths of these deleted files you can use debugfs -R "ncheck 320236" replacing the number with your particular inode.

Inode   Pathname
320236  /path/to/file

From here you can also inspect the contents of deleted files with cat. (NOTE: You can also recover from here if necessary).

Reference here.

For future precaution you use Inotify Tools. then you can use the inotifywait command to listen for events happening for the specified directory.

Specifically if you want to watch for deleted files and folder use this

inotifywait -m -r -e delete directory_name

and log this output in some file.

And I would also recommend you to look for iwatch.

  • 3
    The debugfs way works a lot better in theory than it does in practice. It takes forever and a day to resolve a name from an inode, and chances of still having useful information after ~30 days are rather slim. It might let you recover an important file that you deleted accidentally, if you switch to single user and run debugfs immediately. For many files deleted a long time ago, even if you only want the filenames, it probably isn't worth the pain. The inotify way works nicely for logging fs operations, but of course you need to have it running before deleting the files. – Satō Katsura Jun 28 '16 at 6:19
  • @SatoKatsura yes, you are right. but OP has already left with nowhere. I gave possible workaround to get him/her on track. and for inotify I have clearly mentioned, For future precaution. – Rahul Jun 28 '16 at 6:26
  • 2
    Sorry, I wasn't trying to contradict anything in your post, just adding some warning about what it means. – Satō Katsura Jun 28 '16 at 6:30
  • @SatoKatsura No need to apologize. Glad to know your help. – Rahul Jun 28 '16 at 6:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.