Linux list deleted files

How to find which files and folders were deleted recently in Linux?

I just want to know which files and folders were deleted. Recovering those deleted files and folders is not important for me.

You should tell us what filesystem you are using. For example with ext2, ext3 and ext4 You could probably use ext3grep utility to find out information about deleted files. With some scripting it should be possible to put together simple application that lists deleted files based on specific directory. These utilities however needs raw access to disk and as such are extremely dangerous if not used properly (non-blocking read only operations should be completely safe if you remember that writing to disk same time could cause current operation to return broken/incorrect data).

If you use command line to delete the files then the history command is your friend. History command will show you recently used commands.

3 Answers 3

Use find to search by modification time. For example, to find files touched in the last 3 days:

find /home/sam/officedocuments -mtime -3

For «older than 3 days», use +3 .

Pretty much impossible. When a file is deleted, it’s simply gone. On most systems, this is not logged anywhere.

«Pretty much impossible» This is just plain wrong and because of this I have to downvote this. Deletion times are stored in some filesystems, example of such fs is ext3 filesystem. ext3grep might help when hunting down. I got superuser.com/a/433785/132604 that has some information and links to utilities that could be used to find (possibly recover too) deleted files and information about them. When you delete file, in most filesystems, it is not actually removed but marked as space that could be overwritten in demand.

You might be able to restore files from a backup and compare a list of those files with the ones on the filesystem. That would yield a list of missing and newly created files. Grawity’s answer already show you can filter on time, thus you can limit that to only the deleted files.

You should probably install Inotify Tools. then you can use the inotifywait command to listen for events happening for the specified directory.

Specifically if you want to watch for deleted files and folder use this

inotifywait -m -r -e delete dir_name 

and log this output in some file.

Hope this solves your problem

Sound like best approach for this. There’s promising cli-app/daemon named iwatch that you might want to include in your answer. +1 for using right tools to solve problem.

ravi, @SampoSarrala — is this applicable if I want to watch files in the / root, taking into account mounting/unmounting drives? I would guess, in that case the only thing viable for keeping a deletion log would be a kernel module that would hook into unlink (see stackoverflow.com/questions/8588386/…); also man inotifywait states: «—recursive: Warning: . this option while watching . a large tree, it may take quite a while. Also, . the maximum amount of inotify watches per user will be reached. The default maximum is 8192;«

I wonder if there is also a way to find out which process deleted the file (say a cron job) where applicable. Have a case of files mysteriously disappearing.

Linux does not generally ask for confirmation before removing files, assuming you’re using rm from the command line.

To find files modified in the last 30 minutes, use touch —date=»HH:MM» /tmp/reference to create a file called reference with a timestamp from 30 minutes ago (where HH:MM corresponds to 30 minutes ago). Then use find /home/sam/officedocuments -newer /tmp/reference to find files newer than the reference.

If you deleted files using a GUI tool, they may still be in some kind of «trash can». It depends on what you’re using for a desktop environment. If you used rm from the command line, then try one of the utilities mentioned in this answer. (Hat tip to @Sampo for that link.)

Источник

How to list recently deleted files from a directory in Linux?

If you’ve accidentally deleted a file on your Linux system, you may be able to recover it. Fortunately, when a file is deleted in Linux, it doesn’t actually get wiped from the file system immediately. Instead, it’s marked as free space and can still be retrieved until it’s overwritten by new data. In this article, we’ll discuss different ways to recover recently deleted files in Linux. Here are a few methods to get started:

Method 1: Using ‘Undelete’ Command Line Utility

To list recently deleted files from a directory in Linux using the ‘Undelete’ command line utility, follow these steps:

sudo apt-get install sleuthkit

1. Once installed, navigate to the directory where you want to list recently deleted files from.
2. Run the following command to list all recently deleted files in that directory:

Replace with the name of the device or partition where the directory is located.

1. If you want to list only the recently deleted files from a specific directory within the device, run the following command:

Replace with the path to the directory you want to list recently deleted files from.

1. You can also specify a time range for the deleted files by using the ‘-t’ option. For example, to list all files deleted within the last 24 hours, run the following command:

This will list all files deleted within the last 24 hours from the specified device.

That’s it! By following these steps, you can easily list recently deleted files from a directory in Linux using the ‘Undelete’ command line utility.

Method 2: Using ‘Test Disk’ Tool

sudo apt-get install testdisk

Select the disk you want to recover >[Proceed]

Select the partition type >[Intel]

Select Analyze >[Quick Search]

Select the partition you want to recover >[Write]

Choose the directory where you want to save the recovered files >[Quit]

That’s it! You have successfully recovered the recently deleted files using TestDisk tool.

Method 3: Using ‘Foremost’ Tool

To list recently deleted files from a directory in Linux using the ‘Foremost’ tool, follow these steps:

sudo apt-get install foremost

1. Navigate to the directory where you want to list recently deleted files.
2. Run the following command to create an output directory for Foremost:

sudo foremost -t jpg -i . -o output

This will list all the recently deleted JPEG files in the current directory and its subdirectories.

• The ‘Foremost’ tool is a forensic data recovery tool that can be used to recover deleted files from a disk image or a live file system.
• The ‘-t’ option specifies the file type to be recovered. In this example, we are looking for JPEG files.
• The ‘-i’ option specifies the input directory. In this example, we are looking for recently deleted files in the current directory and its subdirectories.
• The ‘-o’ option specifies the output directory where the recovered files will be stored. In this example, we are creating a directory called ‘output’ in the current directory.

Note: This method only works if the files have not been overwritten by new data.

Method 4: Using ‘Recover’ Command Line Utility

To list recently deleted files from a directory in Linux, you can use the ‘recover’ command line utility. This utility can be used to recover deleted files or to list recently deleted files from a directory.

Step 1: Install ‘Recover’ Utility

To use ‘recover’ command line utility, you first need to install it. You can install it using the following command:

sudo apt-get install recover

Step 2: Run ‘Recover’ Utility

Once ‘recover’ utility is installed, you can run it using the following command:

Step 3: Specify the Directory

You need to specify the directory from which you want to list recently deleted files. You can do this by specifying the path to the directory after the ‘-w’ option. For example, to list recently deleted files from the ‘/home/user/Documents’ directory, you can use the following command:

sudo recover -l -w /home/user/Documents

Step 4: View the List of Recently Deleted Files

After running the above command, ‘recover’ utility will list all the recently deleted files from the specified directory. You can view the list of recently deleted files in the terminal.

Example Code

sudo apt-get install recover sudo recover -l -w /home/user/Documents

This will list all the recently deleted files from the ‘/home/user/Documents’ directory.

Источник