LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 08-20-2009, 12:28 AM   #1
saurabh_s2
LQ Newbie
 
Registered: Aug 2009
Posts: 1

Rep: Reputation: 0
Unhappy How to retrieve deleted files


While running an application on LINUX machine one of the file got deleted mysteriously(or to be precise we were not able to figure out how was the file getting deleted) from the folder which has drwxrwxr-x permissions.

I wanted to know if there is any method for retrieving that deleted file or is there any method to get the information on how was that file deleted.

Is there any method by which we can monitor a file for deletion or modification and when this happens an automated mail be sent to the root user?

We are running RHEL5
 
Old 08-20-2009, 12:35 AM   #2
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.9, Centos 7.3
Posts: 17,362

Rep: Reputation: 2377Reputation: 2377Reputation: 2377Reputation: 2377Reputation: 2377Reputation: 2377Reputation: 2377Reputation: 2377Reputation: 2377Reputation: 2377Reputation: 2377
If you are still using that partition, the chances of recovery are low.
There are many theads here at LQ about this, try the Search option.
A popular recovery tool is photorec.
For realtime notification of file changes, google dnotify and/or inotify.
 
Old 08-20-2009, 12:37 AM   #3
mesiol
Member
 
Registered: Nov 2008
Location: Lower Saxony, Germany
Distribution: CentOS, RHEL, Solaris 10, AIX, HP-UX
Posts: 731

Rep: Reputation: 137Reputation: 137
Hi,

to restore files on Linux a backup is required. The is nothing like DOS undelete command or Trash Bin for files deleted on a shell system.

To get information on who has deleted the file, you can check the history files for each user. If an automated process or a program has deleted the file, it will nearly not possible to find some information. Check the application you were running, eventually this will help.

There are various tools for file monitoring, best you cover out what exactly are your needs. Take a look at sf.net. Also you can write a script which will check your file(s). Take a look at lsattr man page to find out how to prevent a file from deleting.
 
Old 08-20-2009, 12:45 AM   #4
FragInHell
Member
 
Registered: Sep 2003
Location: Sydney Australia
Distribution: Redhat, Centos, Solaris, Ubuntu, SUSE
Posts: 282

Rep: Reputation: 45
Hi,

You can also audit files and place flags on them, these events are then logged to the messages. For example we audit all of /etc so any file changes are audited to the systems messages file.
Here is a useful guide http://www.cyberciti.biz/tips/linux-...to-a-file.html
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
retrieve files for deletion props666999 Slackware 5 06-14-2006 10:03 PM
How to retrieve deleted files kumary Linux - General 3 01-26-2006 08:45 AM
I deleted some files, how do i retrieve it? novkhan Linux - General 4 10-31-2004 02:57 PM
how to retrieve deleted file in linux? markhod Linux - Software 4 09-08-2004 10:29 AM
Acidentally deleted /var/www anyway to retrieve it? lucastic Linux - Software 1 12-28-2003 04:49 AM


All times are GMT -5. The time now is 01:16 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration