After a reboot today, for no apparent reason, I seemingly lost a dir .dotfiles from inside my $HOME dir which held all my config dotfiles.

It will be a huge pain to recreate them but that's what I'm doing now. I have a slightly dated backup to work from.

Is there a log I can view that will show all deleted or removed files and directories, either by me manually, possibly by accident, or by another application maybe?

Ubuntu 14.04LTS

  • Just a heads up. When you're considering doing any form of recovery, you must avoid writing to the same drive. You probably prevented yourself from restoring anything. A simple deletion is usually easily reversible when there's nothing that overwrote it. And to directly answer your question, if you're asking, I'm assuming you haven't set up anything to track these things so no you won't find any logs of it. – Julie Pelletier Feb 3 '17 at 3:23
  • thank you @JuliePelletier . Today I was remote and didn't have a external drive to boot live from so that wasn't an option. I used testdisk for about half an hour and then grepped the results and mostly everything it grabbed was months old rather than hours – winchendonsprings Feb 3 '17 at 3:38
  • 3
    Maybe check your bash history. Directories don't usually just go missing. – hermancain Feb 3 '17 at 4:40
  • I wonder if it was really lost, or just, as you say, seemingly lost. Did you rename it? Is it a checkout of a Git repository? – Kusalananda Nov 23 '18 at 9:11

There is no log of file operations, unless you've explicitly set one up. Setting a log of file operations is unusual and tends to hurt performance.

As hermancain suggested in a comment, you can search your shell history (less ~/.bash_history in the default configuration) and try to find a command that removed or moved the directory. This may have been a command with wildcards, so you might not find the actual directory name in the history, only a wildcard pattern that matches it.

In case the directory has been moved, or you misremembered the path, try locate somefile where somefile is the name of a file that was in this directory, or even part of the name.

Tip: put your dot files under version control.

  • Enabling process accounting would be another option. – Kusalananda Jun 18 '19 at 21:04
  • @Kusalananda Process accounting would only tell you something like “this user called rm at this time”. It wouldn't tell you which files were removed, or about files removed by an application that isn't obviously about removing files. You'd need something more intrusive such as audit logs. – Gilles 'SO- stop being evil' Jun 18 '19 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.