Latest LQ Deal: Latest LQ Deals
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 05-10-2010, 09:05 AM   #1
Registered: Mar 2008
Posts: 69

Rep: Reputation: 15
samba deleted files forensics


I'm on the horns of a dilemma. Someone of the local network deleted a directory from the public share and I want to find who did this.
I have searched the smbd logs but no answer till now. How can I easily do it ? I know the date but the logs show nothing, I found that when I create a file/directory on that share samba logs this event. So, for deleted files/folders there must be some notes somewhere ... The thing is I don't really know for what word to grep.

Can anyone give me some tips on this ??

Thanks you!
Old 05-10-2010, 09:19 AM   #2
Simon Bridge
LQ Guru
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 198Reputation: 198
Someone of the local network deleted a directory from the public share and I want to find who did this.
What do you hope to gain from this information?

Do not keep your only copy on a publicly writeable directory. Sadly there are idiots out there who feel it is their mission to hose sysadmins who don't know this.

You can set up samba to monitor user logins.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Deleted files through samba share; Recovery?? Zero-0-Effect Linux - General 4 05-01-2009 03:30 PM
samba public share files deleted npubudu Linux - Software 4 02-11-2009 06:19 AM
Recovering Deleted Files In Samba - Is it possible? romeo_tango Linux - Networking 4 11-27-2007 09:58 PM
Samba - Files being being deleted Ori Linux - Newbie 2 06-11-2004 01:19 PM
Samba logs files deleted by users?? Goma_2 Linux - Software 0 09-22-2003 07:37 AM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 04:29 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration