28

I am having one particular folder (/home/sam/officedocuments) which is having hundreds of folders and files. I think I deleted some files and folders by mistake but I'm not sure.

How to find which files / folders were:

  • deleted recently in Linux?
  • changed recently in Linux?

I just want to know which files and folders were deleted. Recovering those deleted files and folders is not important for me.

OS: CentOS

djsmiley2kStaysInside
  • 6,943
  • 2
  • 36
  • 48
sumit
  • 445

3 Answers3

13

You should probably install Inotify Tools. then you can use the inotifywait command to listen for events happening for the specified directory.

Specifically if you want to watch for deleted files and folder use this

inotifywait -m -r -e delete dir_name

and log this output in some file.

Hope this solves your problem

Irfan
  • 241
ravi
  • 131
1

…changed recently in Linux?

Use find to search by modification time. For example, to find files touched in the last 3 days:

find /home/sam/officedocuments -mtime -3

For "older than 3 days", use +3.

…deleted recently in Linux?

Pretty much impossible. When a file is deleted, it's simply gone. On most systems, this is not logged anywhere.

grawity
  • 501,077
-1

Linux does not generally ask for confirmation before removing files, assuming you're using rm from the command line.

To find files modified in the last 30 minutes, use touch --date="HH:MM" /tmp/reference to create a file called reference with a timestamp from 30 minutes ago (where HH:MM corresponds to 30 minutes ago). Then use find /home/sam/officedocuments -newer /tmp/reference to find files newer than the reference.

If you deleted files using a GUI tool, they may still be in some kind of "trash can". It depends on what you're using for a desktop environment. If you used rm from the command line, then try one of the utilities mentioned in this answer. (Hat tip to @Sampo for that link.)

Community
  • 1
bstpierre
  • 1,350