LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-10-2010, 09:05 AM   #1
mad_penguin
Member
 
Registered: Mar 2008
Posts: 69

Rep: Reputation: 15
samba deleted files forensics


Hi!

I'm on the horns of a dilemma. Someone of the local network deleted a directory from the public share and I want to find who did this.
I have searched the smbd logs but no answer till now. How can I easily do it ? I know the date but the logs show nothing, I found that when I create a file/directory on that share samba logs this event. So, for deleted files/folders there must be some notes somewhere ... The thing is I don't really know for what word to grep.

Can anyone give me some tips on this ??

Thanks you!
 
Old 05-10-2010, 09:19 AM   #2
Simon Bridge
LQ Guru
 
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 198Reputation: 198
Quote:
Someone of the local network deleted a directory from the public share and I want to find who did this.
What do you hope to gain from this information?

Do not keep your only copy on a publicly writeable directory. Sadly there are idiots out there who feel it is their mission to hose sysadmins who don't know this.

You can set up samba to monitor user logins.
http://forums.novell.com/novell-prod...ogin-user.html
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Deleted files through samba share; Recovery?? Zero-0-Effect Linux - General 4 05-01-2009 03:30 PM
samba public share files deleted npubudu Linux - Software 4 02-11-2009 06:19 AM
Recovering Deleted Files In Samba - Is it possible? romeo_tango Linux - Networking 4 11-27-2007 09:58 PM
Samba - Files being being deleted Ori Linux - Newbie 2 06-11-2004 01:19 PM
Samba logs files deleted by users?? Goma_2 Linux - Software 0 09-22-2003 07:37 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 01:18 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration