How Do You Check Who Deleted Files in Linux?
Contents (Note: You Can Find the Name of Your Disk by Running Df / in the Terminal). Once in Debug Mode, You Can Use the Command Lsdel to List Inodes...
(NOTE: You can find the name of your disk by running df / in the terminal). Once in debug mode, you can use the command lsdel to list inodes corresponding with deleted files. To get paths of these deleted files you can use debugfs -R “ncheck 320236” replacing the number with your particular inode.
How do you find out who deleted the files in Linux?
2 Answers
- check the OS syslog (/var/adm/syslog/syslog.log for hp-ux, /var/log/messages for linux)
- Try the last commando to get a list of who logged on when.
- Check the command histories of the sidadm, root user, use the history command, or the h alias.
- Check if there are scripts running, which regularly delete files.
4 февр. 2016 г.
Must Read
How can I find out who deleted a file?
Open the Event Viewer and search the security log for event ID 4656 with a task category of “File System” or “Removable Storage” and the string “Accesses: DELETE”. Review the report. The “Subject: Security ID” field will show who deleted each file.
Maya is a hardware enthusiast who tests and reviews smart home devices, smartphones, wearables, and audio gear. She focuses on practical consumer value and build quality.
