Deleted files 1

[MikeHaith]

Is there a way to determine which user may have deleted files on a system? Everyone claims they did not do it, but never the less, the files are gone.

Thanks for your help

Mike

 

[KenCunningham]

If your users are using ksh, bash, or csh, there should be a history file (.sh_history in ksh for example) in each user's home directory. If it's a fairly recent event, the history variable is set large enough and your users aren't savvy enough to delete or change the history, you could gather these up and grep them for rm commands.

 

[MikeHaith]

Thank you for your help. I will check the history files and see what is in there.

Mike

 

[sedj]

Bear in mind, I've found that the history is 100% reliant - I've seen cases where I *know* I've done certain commands, checked the history for some reason and have not found entries ...

--------------------------------------------------
Free Java/J2EE Database Connection Pooling Software

http://www.primrose.org.uk