-   Linux - General (
-   -   Time Of Deletion Log? (

XAGXAGUL 07-11-2003 11:37 AM

Time Of Deletion Log?
Is there a way to determine the exact time a file was deleted?
And if so, which user deleted it and so forth. And does linux have a recover deleted files program available.

Im using Redhat Linux 8

Tinkster 07-11-2003 05:56 PM

Nope, and depends.

The only thing you could do is set up
aide (or tripwire, or the like) to monitor
the filesystem and log activities like deletion.

Ext2(3) come with a undelete-feature, Reiser
doesn't, and for jfs and xfs I don't know :}


Dark_Helmet 07-12-2003 12:55 AM

Out-of-the-box, Tinkster is right.

However, you could MAKE your own log file. This might be more work than it's worth, but you can always write a script to replace the standard rm command. When the replacement script is used, you could have it create a small log somewhere saying what file was deleted, by whom, and what the time was. You could also mimic an undelete. Instead of actually deleting the file, you could compress it, and shove it into a hidden directory. But that would mean you'd have to manually clean it out every so often (sort of like the Trash can in the Red Hat Desktop and the Recycle Bin in Windows). And of course, once it's gone from there, it's gone for good.

Then again, you could go the standard route and just get in the habit of making backups.

It's all a matter of how much work you're willing to do for the feature.

unSpawn 07-12-2003 10:24 AM

I vaguely remember there's a library that's catch unlink calls, uses LD_SO_PRELOAD IIRC, shame I can't remember the URI, but it shouldn't be hard to Google for.

For Ext2/3 there are aprox 4 recovery utils and one recovery suite, see, post #5

All times are GMT -5. The time now is 04:57 PM.