I plan to reinstall my operating system since I messed up some stuff. Access to files and folders is painfully slow sometimes, even if they contain just a few files.

But of course, I don't want to do everything again. I remember adding a few aliases for ssh to make my daily work more convenient, I changed some syntax-highlighting files for gedit and probably a lot more than I currently remember.

Is there a way to easily see which files were modified by a specific user? Alternatively, is there a way to find files, not found in a fresh installation? Backing up the stuff in the home directory is easy, but I don't want to search through every single directory just to remember "Oh, I put something there as well".

  • What OS are you running? – jordanm Jun 14 '13 at 18:58
  • Ubuntu, but this should be distribution independent, shouldn't it? – stefan Jun 14 '13 at 18:59
  • @stefan Package management is one of the major differences between distributions. – Gilles Jun 16 '13 at 1:11

You can easily look for files that belong to a specific user:

find -xdev / -user bob

Unix doesn't keep track of who modified a file.

There is no easy way to locate system files that you've changed. The normal way to maintain a unix system is to let the OS manage its own files and put your own files in separate directories. On Linux, the convention is that

  • /bin, /sbin, /lib and /usr outside /usr/local belongs solely to the distribution;
  • /usr/local belongs solely to the system administrator;
  • /etc is populated by the distribution but may be modified by the distribution.

Your home directory, of course, belongs to you.

When you do things like adding aliases for ssh or syntax highlighting files for Gedit, do it in /usr/local if you want them to be available to all users, or in your home directory otherwise.

If you really need to change something under /usr because an application only looks for files there and not under /usr/local, put the actual file under /usr/local and make a symbolic link under /usr.

To keep track of files that you've changed in /etc, I recommend etckeeper. All good distributions (including) offer it. (If your distribution doesn't, take this as a commentary on your distribution.)

You can go and look for files that have been modified from the distribution-provided versions. This is different for every package manager. Since you mention Ubuntu, the low-level package management tool is dpkg. For each package, there is a list of files with their checksums in /var/lib/dpkg/info/PACKAGENAMES.md5sums. You can compare the list with what you have installed on your system.

sort /var/lib/dpkg/info/*.md5sums >/tmp/packaged.md5sums
cd /
find bin etc lib sbin usr -path usr/local -prune -o -exec md5sum {} + | sort >/tmp/actual.md5sums
comm -23 /tmp/actual.md5sums /tmp/packages.md5sums

I remember adding a few aliases for ssh to make my daily work more convenient, I changed some syntax-highlighting files for gedit and probably a lot more than I currently remember.

If I understand your question correctly, isn't this the entire point of the /home directory structure? Almost all per-user configurations that you have made will most likely be found in your home folder. For gedit for example, I would bet that there is a folder called .gedit in your home folder containing individual configurations for that software.

You might not want to restore your entire home folder, but at least if you back it up you can add these things in manually later, as in when you discover your gedit configuration is gone, just close gedit and copy in your old .gedit folder -- and so on.

For historical record keeping of changes to your text files, you might want something like etckeeper.

  • As I've written in the question: It's not about the home directory. E.g. I have a custom script placed in /usr/sbin/ for convenience (that might be stupid, I don't know, but it happened). It's about "what files did I touch?". – stefan Jun 14 '13 at 19:08
  • 1
    Another example: The style file for gedit resides in /usr/share/gtksourceview-3.0/styles/. That's far from /home/ and easily missed – stefan Jun 14 '13 at 19:13
  • I know this is completely unhelpful, but I would say that 1) You should have a symlink in /usr/sbin and not the actual script (hindsight is always 20/20), and 2) I'm not familiar with how gedit does things but I would say that it arguably makes more sense to store the styles of users in their home folders (both vim and irssi does this to my knowledge). Again, not helpful to blame the authors. – pzkpfw Jun 14 '13 at 19:15

If possible, you may wish to preserve the existing installation, and to do a fresh install into currently unused disk space (or back up to a separate (external?) disk, and reinstall.)

Once the fresh install is complete, then mount the old install on (say) /old (or each of the file-systems from the old install, on (say) /old/root , /old/usr , /old/home, etc.) and then use "diff -r / /old" to help identify files present in /old that are not present in the fresh install in / . Expect lots of false positives from differing versions of installed software. Minimize those by trying to install exactly the same setup (distro, OS version, package selection). This is not an easy approach, but should be exhaustive - and perhaps exhausting. Good luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.