Okay, this is strange. We have a folder on our internal network that just disappeared. I realize it was likely deleted, but how do I tell for sure what happened to it? I already checked history on root to see if it was rm'd but it wasn't. Hopefully someone was just in windows and accidentally moved it.

Any ideas on how I can figure this out? It's a Fedora Core 3 server running a Samba (3.0.10) share for the Windows users. I tried Googling for a few different related terms and didn't find anything. Perhaps there's a log for all users I don't see? I could grep through that log if I could find it.

The reason I can't just grep for the folder name is because that folder name is incredibly common. I tried that and got over 50k lines of matches. Unless someone knows a way to grep for JUST folders called XXX. Right now my grep knowledge is limited, I normally just use "grep -rl "whatever" *".

You can run the find command:

find / -name "*foldername*"

Well, that worked just about as well as grep did. Everything, including files, not just folders came up. Although this did return fewer matches as it did not look inside of the files, I believe.

Is there no way to further narrow the results down to only folders? I'm still dealing with 50k+ (my ssh client is set to stop at 50k lines) files. I'd set my scrollback further, but my computer already runs slow with that much on the screen as it is. I've only got 512mb ram on the laptop that I use to ssh in.

Use:

find / -type d -mount -name "*foldername*"

From 'man find':


-mount : Don’t descend directories on other filesystems.

-type d : directory

Yep, this worked perfectly. I have no idea why I always try google before man. Guess I won't make that mistake again.

Thanks much!

In addition to find one could also use (s)locate, if the database is updated:
Run as root,
updates the (s)locate database. Then
searches the database for 'directoryname' (don't use asterisks * or other wildcards, unless the filename includes them). You can then use grep with the information to narrow it down more.

By the way, I'm not sure what the official naming scheme of RedHat products is at the moment, but I always tend to think "RedHat x" where x is a version number, refers to the old RedHat Linux distributions that ended with RedHat 9. At some point I thought the newer ones were either Fedora Core x or RedHat Enterprise Linux (RHEL) x..

Erm, nope. That solution doesn't do much there for me. The find thing totally looked solely for directories. Locate looks for everything, I believe.