3

After a reboot today, for no apparent reason, I seemingly lost a dir .dotfiles from inside my $HOME dir which held all my config dotfiles.

It will be a huge pain to recreate them but that's what I'm doing now. I have a slightly dated backup to work from.

Is there a log I can view that will show all deleted or removed files and directories, either by me manually, possibly by accident, or by another application maybe?

Ubuntu 14.04LTS

winchendonsprings
  • 294
  • Just a heads up. When you're considering doing any form of recovery, you must avoid writing to the same drive. You probably prevented yourself from restoring anything. A simple deletion is usually easily reversible when there's nothing that overwrote it. And to directly answer your question, if you're asking, I'm assuming you haven't set up anything to track these things so no you won't find any logs of it. – Julie Pelletier Feb 03 '17 at 03:23
  • thank you @JuliePelletier . Today I was remote and didn't have a external drive to boot live from so that wasn't an option. I used testdisk for about half an hour and then grepped the results and mostly everything it grabbed was months old rather than hours – winchendonsprings Feb 03 '17 at 03:38
  • 3
    Maybe check your bash history. Directories don't usually just go missing. – hermancain Feb 03 '17 at 04:40
  • I wonder if it was really lost, or just, as you say, seemingly lost. Did you rename it? Is it a checkout of a Git repository? – Kusalananda Nov 23 '18 at 09:11
  • Does this data recovery answer your question. It is an another SE question that has a solution using debugfs – Ayush Sep 02 '21 at 14:57

1 Answers1

1

There is no log of file operations, unless you've explicitly set one up. Setting a log of file operations is unusual and tends to hurt performance.

As hermancain suggested in a comment, you can search your shell history (less ~/.bash_history in the default configuration) and try to find a command that removed or moved the directory. This may have been a command with wildcards, so you might not find the actual directory name in the history, only a wildcard pattern that matches it.

In case the directory has been moved, or you misremembered the path, try locate somefile where somefile is the name of a file that was in this directory, or even part of the name.

Tip: put your dot files under version control.

Community
  • 1
Gilles 'SO- stop being evil'
  • 829,060
  • Enabling process accounting would be another option. – Kusalananda Jun 18 '19 at 21:04
  • @Kusalananda Process accounting would only tell you something like “this user called rm at this time”. It wouldn't tell you which files were removed, or about files removed by an application that isn't obviously about removing files. You'd need something more intrusive such as audit logs. – Gilles 'SO- stop being evil' Jun 18 '19 at 23:03