Who deleted my files Post: 302564763

Sponsored Content

Operating Systems AIX Who deleted my files Post 302564763 by juredd1 on Friday 14th of October 2011 02:17:40 PM

10-14-2011

Registered User

Who deleted my files

Just looking for some guidance on how to figure out who might have deleted some files off one of my systems.

These files are not root owned files so could be deleted by a handful of folks in the group responsible for these files besides the root users.

Anyway I have been tasked with trying to figure out where they went. I can see from our backup server they were there on Sept. 26th and gone on Sept. 27th. I have tried reviewing the .sh_history file for each user but have just performed a copy of the .sh_history file of each user to a tmp location and then review the files with vi.

I have done this for the root user as well but notice after the copy that the last timestamp in the file is from yesterday. None of the commands I have run today are there. However if I use the fc command they are shown. My concern is that will be the case for the copy of the other users history file but don't have a way to properly format the history file with fc unless I log in as each user. The other issue I have is some uses history file does not appear to go back that far so I am having to restore from the previously mentioned time frame.

Just looking for any thoughts on how to better come up with an answer. Something had to happen to those files but thus far I am coming up empty.

I think I understand that if someone wanted to delete these files and not be found they could edit their own history file. I don't think it's the case of an on purpose delete as the files are still on the source server which they can delete as well. I can get them back from the source server or from backup but just would like to figure out how they got deleted to avoid this questioning from the customer in the future.

Thanks.

juredd1

View Public Profile for juredd1

Find all posts by juredd1

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Retrieval of deleted files

We have a situation in a large dept of programmers where critical accounting data files were deleted. Is there any way in UNIX to trace deletions and or possibly retrieve the deleted file?

2. UNIX for Dummies Questions & Answers

restoring deleted files

I had a user run, by accident, the following line command on our UNIX server: rm -f /usr/* This apparently deleted some needed files on your system. Having very limited knowledge in UNIX, I thought I would ask the group if anyone knows how I can recover these file? The version of UNIX is...

3. AIX

recover deleted files

How to recover deleted files in AIX ?

4. Shell Programming and Scripting

Finding deleted files

One of the files got deleted and i want to find who deleted that file. I think we can get the list using history command. Could you please let me know how to get the list of rm commands from history and who previously logged in and did that? Any other suggestions other than history also...

5. UNIX for Dummies Questions & Answers

Retrieving deleted files

I mistakenly deleted a script from the UNIX server. Is there any command i can type that i will retrieve my script?

6. Shell Programming and Scripting

how to restore the deleted files

hi, if i delete a file from /home/san/abc.cpp in linux/unix and i want to restore it back how to do that ?

7. UNIX for Dummies Questions & Answers

Any way to retrieve deleted files?

:eek: I accidently removed some files using 'rm'. Is there any way to retrieve these files if they were deleted through 'rm'?

8. UNIX for Advanced & Expert Users

deleted all files - rm *

Hi All, I am using Fedora Core and Windows Xp. I deleted all the files from root directory. When i am trying to restart the computer it showing some grub > prompt. What i will do ? I have lots of data in XP OS. Please help me i used # rm *

9. Linux

Need help with deleted files

Hello. I am having a problem and I was wondering if I could get some help from here. I changed into a directory with the cd command and I wanted to delete a folder and all of its subdirectories, so I went ahead and did a rm --recursive * in my current directory to realize that I was in the wrong...

LEARN ABOUT DEBIAN

miwm

MIWM(1) 						      General Commands Manual							   MIWM(1)

NAME

       miwm - a minimal appearance, full-function window manager

SYNOPSIS

       miwm

DESCRIPTION

       MIWM is Ben Wise's MInimal Window Manager. It is pronounced 'my whim'.

       The  goal  of  miwm is to be a fully functional window manager, while retaining a very spare (Zen or Spartan, as you please) appearance and
       command-set.

WARNING

       This man page is VERY MUCH under construction. It is not complete, and blatantly contains leftover pieces of the man page I used as a  tem-
       plate. Do not rely on anything you find here.

COMMANDS

       The notation for describing commands is that Mouse-1-frame means 'button 1 click on frame', C-Mouse-3-root means 'control button 3 click on
       root',

       Mouse-1-frame
	      Raise.

       Mouse-2-frame
	      Move.  Mouse-2-root Select virtual workspace.

       Mouse-3-frame
	      Hide.

	      Filenames passed to
	      miwm can be directories or deleted files.  If a directory that is not deleted is passed to miwm, then the deleted files or  directo-
	      ries in it will be restored; if the recursive option is specified, then all deleted files or directories in any of its children will
	      be restored as well.

       The shell wildcards * and ?, as well as shell brace notation using [ and ], are interpreted correctly by miwm.	It  is	possible  to  pass
       wildcards  to  the program without the wildcards being intercepted by the shell by setting noglob (in csh) or by quoting the wildcards.	To
       delete a file that actually has a wildcard in its name, you must precede the quoted wildcard with a quoted backslash.

       If no files are specified on the command line, miwm goes into interactive mode.	In interactive mode, the user is prompted to  enter  files
       to be restored, one file per line.  Typing a carriage return on an empty prompt line exits the program.

       Wildcards  and  quoting backslashes can be entered directly at the prompt without any shell interference (which is the main reason there is
       an interactive mode).

OPTIONS

       Miwm No command-line options.

KNOWN BUGS

       The code is too complicated.  No icon support.

SEE ALSO

       9wm(1), aewm(1)

AUTHOR

       Ben Paul Wise

RESTRICTIONS

       Copyright (c) 1998-2003 by Ben Paul Wise.  All rights reserved.	MIWM(1) specifies the terms and conditions for redistribution.

Ben Paul Wise							    06 May 2003 							   MIWM(1)