Finding "WHO DID THIS?"
 

Dear all,
Today I have a serious problem, a folder's content is gone. All of them.
But luckily it was somehow moved by someone to another place.

My question is, I wanted to find out who the person is.
I know the file was moved at - let's say - 10.00
Is there any log file that store what things did, and who did that?

Thanks in advanced.

YoChan

What kind of a system are you on?

In Linux/BASH, I found /var/log/auth* showing who logged in and when.

Filesystem actions are not ordinarily logged.

I think the best you can do is use the logs of who has logged into the system, which will probably be in /var/log/auth.log
Exactly what is logged will I think depend on what login manager you use (KDM, GDM, XDM, SLiM, etc)

Or you could just run "last" which saves you some typing

@All:
Thank you for the replies :)
I'll give it a shot.

BUT if my user move the file using SAMBA, is there any log file on what user samba's doing??? (_ __)!