Linux - GeneralThis Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I have a lot of media files on my PC. 2 years ago I finally got around to backing these up and I have an rsync job which runs every night to ensure any new stuff is also archived.
Last night I noticed a directory was missing! I checked the backup and it was present there. I checked my records and I accessed this directory on November 2 this year. So between November 2 and December 14 I must have inadvertently deleted this directory! I am puzzled about why I did this.
I checked my bash_history and that does not stretch far enough back to provide any useful info. Is it possible to check the history of a folder? EG. interrogate any history of the parent folder /data/backup? This directory sits on a USB HDD which is referenced in fstab and mounted at boot time.
Like I say, I can only assume I deleted the directory and it is backed up. Still I am interested to know when I did this. Maybe I can jog my memory if I know more detail.
Cheers
Last edited by onebuck; 12-14-2014 at 07:07 PM.
Reason: correct subject title
@frankbell: if his ~/.bash_history doesn't cover aforementioned period then reading it doesn't make sense?..
Quote:
Originally Posted by timl
(..) I must have inadvertently deleted this directory! I am puzzled about why I did this. I checked my bash_history and that does not stretch far enough back to provide any useful info.
First of all people usually find after the fact that Linux doesn't come with a perfect audit trail out of the box to cover such eventualities...
Quote:
Originally Posted by timl
Is it possible to check the history of a folder? EG. interrogate any history of the parent folder /data/backup?
If you define "history" as having the foresight to use rsync with "--log-file=" then yes, but if you define it as relying on file system meta data then no. (It does exist but very short-lived, not authoritative, ergo trying to piece together an audit trail on a file system in use since deletion is one of the "fun" parts of forensics.) That's why I set 'shopt -q -s histappend >/dev/null 2>&1; export PROMPT_COMMAND='history -a' >/dev/null 2>&1', rotate shell history files and use Rootsh to save shell sessions among other things.
I'll have a look through your post recommendations. The rsync suggestion should be obvious (but not to me). The history file rotation needs a bit further digging so I can understand all the actions.
Maybe you deleted it, but it's also possible you moved it. I suggest you search your system for one of the files contained in the missing directory. That might lead you to the whole missing directory. The modtime of the directory it was moved into may tell you when you moved it.
Edit: For that matter, the modtime of the directory it is missing from may tell you when it was deleted or moved, provided that no other changes to that directory were made in the mean time.
Thanks Beryllos. I checked for traces of the old directory based on the November 2 activity. This did not yield anything.
Now I am even more puzzled (in a progressive sort of way). The date stamp on the upper directory is March 30! I did a few tests in my home directory and both mv & rm change the date/time stamp. Racking my brain to think what I did after November 2. Although, as per my last post I might just put this down in "lessons learned" and add more traceability.
Did you try a simple file search? The files might still be somewhere in your filesystem.
With a GUI file manager, it is surprisingly easy to inadvertently click on a directory and drag it into another directory. It could even happen with the mv command, as this LinuxQuestions thread describes:
The original poster noticed "the files still take up space on the harddrive." That was a clue that the files were not removed, just moved. He located them with a find command.
That thread also suggests you could investigate your missing files by disk usage. If you lost a huge directory (like that user who lost his entire video library), it should free up a lot of disk space. If it didn't free up disk space, the files are probably still somewhere in the filesystem.
I did move the folder on Nov 13 but I have no recollection why I did this. It is quite a size and the original disk was getting full so maybe that was the reason. Now my explanation.
The original folder was on a fixed HDD (not USB as I originally stated)
The new location IS on a USB HDD
when I type "locate filename" this shows no results. I always use locate as a lazy option.
when I type "find / -iname filename" Bingo, I can see the files.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.