One of my directory code where i have stored all my scripts have disappeared . I have no idea on how it got deleted.Could someone pls help me to track-back on what would have happened? I left the office yesterday and today when i just logged in to work with the scripts I could not find the directory code. Do we have any commands to check like.. who was last logged in or what transactions they made..
I use Linux machine..
Who was logged in can be seen with the last command. If you have no auditing running, it is unlikely that you can see who deleted them etc.
Best is to have a backup and restore them if possible.
Thank you.. i have used that command and it gives a big list since, we use same username (i guess) and im not able to sort out who deleted the dir. Alongside im in touch with the unix admin.Any other insights are welcome..
If you all use bash or tcsh, you can check the history files in all home directories. The parent directory if the one that was deleted may have a timestamp reflecting the last change to that directory. This might be useful in narrowing the timeframe of the deletion.
Here is one command to search all the history files for the 'rm' command:
find /home -name .bash_history -print | xargs grep -w rm
When i give as
echo $SHELL # it gives as /bin/zsh
. So whether would i able to use the below command or any other? however i executed it and got only find: /home/lost+found: Permission denied .. .. etc
Each shell has it's own history file. Search these forums or
The respective man pages for details. The comma d
Must be run as root.
Thanks for the guidance both of you... i will search for it..
regarding to this issue...
isn't it possible to get the folder with contents back if nothin overwrote the area?
I mean with help of the vector table this could maybe be undone. I know no simple commands, but there are some purchaseable software solutions to to this.
Maybe also simple commands exists and an expert knows this?
Would you consider a filesystem capable of arbitrary undeletion secure? There's no general purpose UNIX undelete and there really couldn't be. Hopefully his sysadmin has backups.
come on... why you write such things?
just searched with google and directly found a lot of information about this topic.
Unfortunately it's not allowed for me to post URLs (below 5 posts) - but i assume you know how to use google. (if not - search words for me were "unix get deleted file" - i took 3rd from top)
There is for example Midnight Commander mentioned.
It's GNU (free) software, which runs on UNIX OS.
so it's possible to get deleted files back by knownleadge of last date used/created...
It's just not that easy as it is with windows OS.
---------- Post updated at 03:04 PM ---------- Previous update was at 02:57 PM ----------
if you still need to get it back and it's important you may look for GNU free licensed program:
"midnightcommander"
can sometimes undelete files
Mostly because it's true:
- Not general-purpose. Only works for ext2 (and maybe 3) which is becoming rarer these days.
- Instructions refer to decades-old linux versions -- not promising.
- Most importantly it does not work using the instructions given!
People looking for mc undelete tend to get suggested the "recover" utility suite instead but only if they have ext2/ext3 partitions which, again, are becoming rarer these days. We know nothing about his filesystem, in this ignorance anything we can suggest has very good odds of not helping or making things worse. Hence there's no general-purpose solution. We need more information to help.
yeah I admit... it looks like it was not that important, because he does not reply...
I just knew that there were some ways/changes to get files back - not only on windows systems, but also on Unix. Just wanted to help and asked for more knownledged people bacause they may have clear solutions. The questions is frequently asked 
So the program I mentioned is not that often usable but may help if you are lucky. :rolleyes:
You have to be very careful giving advice about data recovery because bad advice can make the problem worse.
also found:
grep -i -a -B10 -A100 'myTextFile' /dev/sda1 > myRecoveryFile.txt[LEFT]vi myRecoveryFile.txt
but could not run these options on my sun os and if you are right this shouldn't work?!
But maybe some ppl want to try it.
[/LEFT]