I accidentally started an rm -rf
on a large directory that I was working in. The directory contains, among other things, a data
directory containing a number of subdirectories that each contain thousands of text files. Essentially it looks like this
$ tree data
data
├── collection0
│ ├── input
│ │ ├── file0.txt
│ │ ├── file1.txt
│ │ ├── ...
│ │ └── file9999.txt
│ └── output
│ ├── file0.txt
│ ├── file1.txt
│ ├── ...
│ └── file9999.txt
├── ...
└── collection99
├── input
│ ├── file0.txt
│ ├── file1.txt
│ ├── ...
│ └── file9999.txt
└── output
├── file0.txt
├── file1.txt
├── ...
└── file9999.txt
I was able to interrupt the rm -rf
process pretty quickly, but of course in the half-second or so of execution time a number of files in other subdirectories were deleted.
My question is, is there a way to ascertain with 100% certainty whether a given subdirectory lost any files during this time? It seems as though the Modify
time on directories that lost files got updated to when the files were deleted, and using this method I think no files in the data subdirectories was deleted (assume 2021-09-08 is the date of the rm -rf
event):
$ find data -mindepth 2 -maxdepth 2 -type d -exec stat {} -c '%n %y' \;
data/collection0/input 2021-08-28 05:45:49.624228368 -0400
data/collection0/output 2021-08-28 05:45:49.624228368 -0400
...
data/collection99/input 2021-08-29 04:55:38.772912003 -0400
data/collection99/output 2021-08-29 04:55:38.772912003 -0400
$ find data -mindepth 2 -maxdepth 2 -type d -exec stat {} -c '%n %y' \; | grep 2021-09-08
$
Is this a reliable method?