# Finding deleted files

**URL:** <https://community.unix.com/t/finding-deleted-files/168225>\
**Category:** Shell Programming and Scripting\
**Created:** [January 11, 2007, 12:18pm UTC](https://community.unix.com/t/finding-deleted-files/168225 "2007-01-11T12:18:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Krrishv](https://community.unix.com/user_avatar/community.unix.com/krrishv/32/3542_2.png) [@Krrishv](https://community.unix.com/u/Krrishv)\
**Post date:** [January 11, 2007, 12:18pm UTC](https://community.unix.com/t/finding-deleted-files/168225/1 "2007-01-11T12:18:52Z")

</div>

One of the files got deleted and i want to find who deleted that file.

I think we can get the list using history command. Could you please let me know how to get the list of rm commands from history and who previously logged in and did that?

Any other suggestions other than history also welcome.

---

<div class="post-metadata">

**Author:** ![Manish\_Jha](https://community.unix.com/letter_avatar/manish_jha/32/5_5575768a8748004e209b776fc1b2916d.png) [@Manish\_Jha](https://community.unix.com/u/Manish_Jha)\
**Post date:** [January 11, 2007, 3:51pm UTC](https://community.unix.com/t/finding-deleted-files/168225/2 "2007-01-11T15:51:27Z")

</div>

try looking for "recover" command in /usr/bin. if it there on your system, it would help you in getting the file as well as it would answer your questions too.

--Manish

---

<div class="post-metadata">

**Author:** ![Krrishv](https://community.unix.com/user_avatar/community.unix.com/krrishv/32/3542_2.png) [@Krrishv](https://community.unix.com/u/Krrishv)\
**Post date:** [January 12, 2007, 12:28am UTC](https://community.unix.com/t/finding-deleted-files/168225/3 "2007-01-12T00:28:28Z")

</div>

I dont have any recovery command in hp-ux or RHLinux. which flavour of unix is this

$ ls -ltr re\*  
-r-xr-xr-x 1 bin bin 24576 Mar 11 2004 rev  
-r-xr-xr-x 2 bin bin 90112 Mar 11 2004 red  
-r-xr-xr-x 2 bin bin 36864 Mar 11 2004 reset  
-r-xr-xr-x 1 bin bin 151 Mar 26 2004 read  
lr-xr-xr-t 1 root sys 22 Aug 10 08:35 revck -\> /usr/old/usr/  
bin/revck  
lr-xr-xr-t 1 root sys 16 Aug 10 08:35 renice -\> /usr/sbin/re  
nice  
-r-sr-xr-x 1 root bin 53248 Oct 17 09:49 remsh  
-r-sr-xr-x 1 root bin 32768 Oct 17 09:49 rexec  
-r-xr-xr-x 1 bin bin 225280 Nov 29 20:15 readmail  
$ pwd  
/usr/bin  
$ uname -a  
HP-UX td191 B.11.23 U 9000/800 1294588977 unlimited-user license

Linux :

$ ls -ltr re\*  
-r-xr-xr-x 1 bin bin 24576 Mar 11 2004 rev  
-r-xr-xr-x 2 bin bin 90112 Mar 11 2004 red  
-r-xr-xr-x 2 bin bin 36864 Mar 11 2004 reset  
-r-xr-xr-x 1 bin bin 151 Mar 26 2004 read  
lr-xr-xr-t 1 root sys 22 Aug 10 08:35 revck -\> /usr/old/usr/  
bin/revck  
lr-xr-xr-t 1 root sys 16 Aug 10 08:35 renice -\> /usr/sbin/re  
nice  
-r-sr-xr-x 1 root bin 53248 Oct 17 09:49 remsh  
-r-sr-xr-x 1 root bin 32768 Oct 17 09:49 rexec  
-r-xr-xr-x 1 bin bin 225280 Nov 29 20:15 readmail  
$ pwd  
/usr/bin  
$ uname -a  
HP-UX td191 B.11.23 U 9000/800 1294588977 unlimited-user license