3

After a reboot today, for no apparent reason, I seemingly lost a dir .dotfiles from inside my $HOME dir which held all my config dotfiles.

It will be a huge pain to recreate them but that's what I'm doing now. I have a slightly dated backup to work from.

Is there a log I can view that will show all deleted or removed files and directories, either by me manually, possibly by accident, or by another application maybe?

Ubuntu 14.04LTS

5
  • Just a heads up. When you're considering doing any form of recovery, you must avoid writing to the same drive. You probably prevented yourself from restoring anything. A simple deletion is usually easily reversible when there's nothing that overwrote it. And to directly answer your question, if you're asking, I'm assuming you haven't set up anything to track these things so no you won't find any logs of it.
    – Julie Pelletier
    Feb 3, 2017 at 3:23
  • thank you @JuliePelletier . Today I was remote and didn't have a external drive to boot live from so that wasn't an option. I used testdisk for about half an hour and then grepped the results and mostly everything it grabbed was months old rather than hours
    – winchendonsprings
    Feb 3, 2017 at 3:38
  • 3
    Maybe check your bash history. Directories don't usually just go missing.
    – hermancain
    Feb 3, 2017 at 4:40
  • I wonder if it was really lost, or just, as you say, seemingly lost. Did you rename it? Is it a checkout of a Git repository?
    – Kusalananda on strike ♦
    Nov 23, 2018 at 9:11
  • Does this data recovery answer your question. It is an another SE question that has a solution using debugfs
    – Ayush
    Sep 2, 2021 at 14:57

1 Answer 1

Reset to default
1

There is no log of file operations, unless you've explicitly set one up. Setting a log of file operations is unusual and tends to hurt performance.

As hermancain suggested in a comment, you can search your shell history (less ~/.bash_history in the default configuration) and try to find a command that removed or moved the directory. This may have been a command with wildcards, so you might not find the actual directory name in the history, only a wildcard pattern that matches it.

In case the directory has been moved, or you misremembered the path, try locate somefile where somefile is the name of a file that was in this directory, or even part of the name.

Tip: put your dot files under version control.

2
  • Enabling process accounting would be another option.
    – Kusalananda on strike ♦
    Jun 18, 2019 at 21:04
  • @Kusalananda Process accounting would only tell you something like “this user called rm at this time”. It wouldn't tell you which files were removed, or about files removed by an application that isn't obviously about removing files. You'd need something more intrusive such as audit logs.
    – Gilles 'SO- stop being evil'
    Jun 18, 2019 at 23:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .