How can I find out which user deleted a directory?
Posted
by
Rob S.
on Ask Ubuntu
See other posts from Ask Ubuntu
or by Rob S.
Published on 2011-06-20T14:42:31Z
Indexed on
2011/06/20
16:39 UTC
Read the original article
Hit count: 374
My Ubuntu server has about roughly 30 active users on it. I personally know everyone using the server. Recently, a few friends and I were working on project. We made a new directory for the project and since everyone knows everyone we didn't bother protecting our work under a bunch of permissions. We should have though, because we woke up this morning to find that someone removed our entire directory.
Our work is backed up every night so it's really not a big deal to restore our work. However, we would like to find out who removed it so we can confront them. So far the best thing we've come up with for finding our culprit is checking everyone's bash history but this is long and tedious and chances are that if there was a malicious intent behind the directory removal that our culprit probably modified theirs to cover their tracks (or of course they might use a different shell).
So, basically, what is the easiest and quickest way to find out who deleted a directory?
Thanks in advance for your time.
© Ask Ubuntu or respective owner