How to list deleted files in UNIX?


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users How to list deleted files in UNIX?
# 8  
Old 05-17-2016
Quote:
Originally Posted by pspriyanka
hi skrynesaver,
if we don't took an backup in that case I am trying to search an deleted files ...
Hello Priyanka,

Yes, we do not have recycle bin in *NIX. We could use soft deletion(usually backup is the BEST option but in case you doesn't have it). We could redefine rm command for the particular user, by changing it in user's DOT profile(eg--> ~/.bashrc). Following are the steps which we could do for same.
I- Create a script let's say soft_deletion_script.ksh, which will be having following commands in it.
Code:
 #!/bin/sh
 mv "$@" /path/to/trash/folder

II- Add this into your DOT profile as follows.
Code:
 alias rm Singh/is/King/move_to_trash.sh

III- To empty your trash periodically, you can configure a cron jobs.
In above code [/path/to/trash/folder/ is the folder where you wanted to keep your delete files.

NOTE: This should be tested into a TEST environment.

Thanks,
R. Singh

Last edited by Don Cragun; 05-17-2016 at 08:15 AM.. Reason: Fix ICODE tags.
# 9  
Old 05-17-2016
Interesting idea Ravinder...

On point III you could use find /path/to/trash/folder/ -mtime +7 -exec rm {} \; in a cron job in order to delete files over a week old (or adjust to suit )...
# 10  
Old 05-18-2016
what do you mean 'list deleted files'? a file is just a name pointing to some data on the disk. if you delete a file (rm) you don't delete data. At least I can't remember right now a filesystem, which deletes data at the same time you delete a pointer to it. You can have many pointers to the same data. In UNIX world they are called hard links or links. If your data has several links and you remove just one of them, you effectively did nothing, except removing this name. If you removed the last link to the data, the data is marked 'free' and can be rewritten, but it doesn't mean it will be rewritten. You can use tools such file system debugger to find data on the disk and give them a new name (link). Or if a program, which uses the deleted file, is still running, you can restore the file on most of the UNIX systems.
# 11  
Old 05-23-2016
If some process has the file still open you can recover it, otherwise no chance.
chekc the link below for more details
Recovering Deleted Files With lsof
This User Gave Thanks to Vit0_Corleone For This Post:
# 12  
Old 08-21-2016
# 13  
Old 08-22-2016
Hi,

I had read this article before, there are a couple of assumptions.
  1. Your system uses a Journal File System.
  2. The system is in the main quiet.

Even if your system uses a JFS of some type, it may be that it is not active - as an example GFS allows you to journal at a file level but it has to be turned on.

On a very busy system it may well be that the inode and data space are reallocated very quickly so the data is over written. As an example, I worked in a wafer fab in the late 90's early 00's. One of the systems was used to control multiple disk less clients and was in receipt of many thousands of files an hour, recovering a file on this system would have been impossible even if it did have a JFS.

Regards

Gull04
This User Gave Thanks to gull04 For This Post:
# 14  
Old 08-23-2016
Quote:
Originally Posted by pspriyanka
Hi All,

Its an interview question. I just want to know the answer of below question.

1) How to list deleted files in unix
It depends on how you deleted the files in Unix. And what tools you have at your disposal. If you use the built in rm then it is lost, but see below. If you use the desktop file manager (dolphin for KDE, thunar for xfce, etc) then they will be in a "trash folder" accessible by the file manager. As RavinderSingh13 points out you can write your own tool that can save "deleted" items until you properly flush them away.

But no matter how you delete them, if your system has locate and the locate database has not been refreshed yet (it normally refreshes overnight), you could try this:
Code:
$ locate "$PWD" | sort > /tmp/myfiles
$ find "$PWD" -print | sort > /tmp/myfiles2
$ comm -23 /tmp/myfiles /tmp/myfiles2

I'm not sure the sort is required with locate. What you will get is a list of lines unique to first file, or if you prefer, a list of files that have been removed since the last refresh of the locate database.
This assumes the files were there overnight, otherwise locate won't list them.

You don't ask about recovering files, but provided the file system is backed up every night the files can be restored from the backup "tape".

Andrew
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

List Files being deleted in a shell script

Good evening, i need your help please I've got a file script thet deletes about half millions of files, and i want those files to be printed in a log file as an evidence those files were removed. #/bin/sh rm "/home/e-smith/files/users/bill/Maildir/cur/1392373930.28512.comp01:2,S" rm... (6 Replies)
Discussion started by: alexcol
6 Replies

2. UNIX for Dummies Questions & Answers

How to list the different files in UNIX?

Hi , I have to find the files from a directory . But the file names are different. for ex. MONTH_AP_TEST_DATA_<timestamp>.dat MONTH_PAY_TEST_DATA_<timestamp>.dat PARTIAL_AP_TEST_DATA_<timestamp>.dat PARTIAL_PAY_TEST_DATA_<timestamp>.dat MULTIPLE_AP_TEST_DATA_<timestamp>.dat... (5 Replies)
Discussion started by: kalidoss
5 Replies

3. UNIX for Dummies Questions & Answers

Generate list of deleted files

I copied all JPEGs from my laptop to an external drive using find . -name "*.jpg" -exec cp '{}' ./media/Backup/pictures \; And then deleted all of them from my laptop. Now, I realize that I need the folder path of all the original JPEGs as the path has the important information. I dont... (1 Reply)
Discussion started by: eshwaconsulting
1 Replies

4. AIX

Who deleted my files

Just looking for some guidance on how to figure out who might have deleted some files off one of my systems. These files are not root owned files so could be deleted by a handful of folks in the group responsible for these files besides the root users. Anyway I have been tasked with trying to... (1 Reply)
Discussion started by: juredd1
1 Replies

5. Linux

Need help with deleted files

Hello. I am having a problem and I was wondering if I could get some help from here. I changed into a directory with the cd command and I wanted to delete a folder and all of its subdirectories, so I went ahead and did a rm --recursive * in my current directory to realize that I was in the wrong... (3 Replies)
Discussion started by: jonnydadesigner
3 Replies

6. UNIX for Advanced & Expert Users

deleted all files - rm *

Hi All, I am using Fedora Core and Windows Xp. I deleted all the files from root directory. When i am trying to restart the computer it showing some grub > prompt. What i will do ? I have lots of data in XP OS. Please help me i used # rm * (8 Replies)
Discussion started by: pritish.sas
8 Replies

7. Shell Programming and Scripting

Shell Script Create List of Deleted Files

Hi, I want to put all the deleted files in a txt file. Because i want to backup my image server which has thousands of jpg images. I wrote a shell script which will copies images from image server to backup image server. I setup a cronjob which runs on every five minutes. & through timestamp it... (8 Replies)
Discussion started by: mirfan
8 Replies

8. UNIX for Dummies Questions & Answers

how to recover deleted files in unix

Hi Experts, by mistake i deleted some files that are very important to the project. is there any way that i can recover those files,there is no backup for that but the details of the file we know. This will be a great help. Thanks (5 Replies)
Discussion started by: namishtiwari
5 Replies

9. UNIX for Dummies Questions & Answers

recover deleted file in unix

hi after using rm command how to recover the deleted file (7 Replies)
Discussion started by: arulkumar
7 Replies

10. UNIX for Dummies Questions & Answers

is it possible to check logs in UNIX who deleted the files?

Hello, is it possible to check logs in UNIX who deleted the files? Is there logs in UNIX besides .sh_history? (1 Reply)
Discussion started by: james_falco
1 Replies
Login or Register to Ask a Question