samba deleted files forensics

mad_penguin · 05-10-2010, 08:05 AM

Hi!

I'm on the horns of a dilemma. Someone of the local network deleted a directory from the public share and I want to find who did this.
I have searched the smbd logs but no answer till now. How can I easily do it ? I know the date but the logs show nothing, I found that when I create a file/directory on that share samba logs this event. So, for deleted files/folders there must be some notes somewhere ... The thing is I don't really know for what word to grep.

Can anyone give me some tips on this ??

Thanks you!

Simon Bridge · 05-10-2010, 08:19 AM

Quote:

Someone of the local network deleted a directory from the public share and I want to find who did this.

What do you hope to gain from this information?

Do not keep your only copy on a publicly writeable directory. Sadly there are idiots out there who feel it is their mission to hose sysadmins who don't know this.

You can set up samba to monitor user logins.
http://forums.novell.com/novell-prod...ogin-user.html