Finding "WHO DID THIS?"

yoachan · 01-17-2010, 10:15 PM

Dear all,
Today I have a serious problem, a folder's content is gone. All of them.
But luckily it was somehow moved by someone to another place.

My question is, I wanted to find out who the person is.
I know the file was moved at - let's say - 10.00
Is there any log file that store what things did, and who did that?

Thanks in advanced.

YoChan

pixellany · 01-17-2010, 10:39 PM

What kind of a system are you on?

In Linux/BASH, I found /var/log/auth* showing who logged in and when.

cantab · 01-17-2010, 10:41 PM

Filesystem actions are not ordinarily logged.

I think the best you can do is use the logs of who has logged into the system, which will probably be in /var/log/auth.log
Exactly what is logged will I think depend on what login manager you use (KDM, GDM, XDM, SLiM, etc)

Tinkster · 01-17-2010, 11:20 PM

Or you could just run "last" which saves you some typing

yoachan · 01-18-2010, 10:04 PM

@All:
Thank you for the replies

I'll give it a shot.

BUT if my user move the file using SAMBA, is there any log file on what user samba's doing??? (_ __)!