Geek Answers Handbook

How to view recently deleted files from a directory?

I'm not even sure if this is easily possible, but I would like to list files that were recently deleted from the directory, recursively, if possible.

I am looking for a solution that does not require the creation of a temporary file containing a snapshot of the original directory structure with which to compare, because write access may not always be available. Edit: If you can achieve the same result by saving the snapshot in a shell variable instead of a file, this will solve my problem.

Sort of:

find /some/directory -type f -mmin -10 -deletedFilesOnly

Edit: OS: I use Ubuntu 14.04 LTS, but the command will most likely work in various Linux containers or Docker containers, most or all of which should be using ext4 , and which I most likely will not have access to making changes.

+5
source share
2 answers

You can use the debugfs utility,

debugfs is an easy-to-use RAM-based file system specifically designed for debugging purposes.

First run debugfs /dev/hda13 in your terminal (replacing /dev/hda13 with your own drive / partition).

(NOTE: You can find the name of your drive by running df / in the terminal).

In debug mode, you can use the lsdel command to display inodes corresponding to the deleted files.

When files are deleted on Linux, they are just not connected, but their inodes (addresses on the disk where the file is actually present) are not deleted

To get the paths to these deleted files, you can use debugfs -R "ncheck 320236" , replacing the number with your specific inode.

 Inode Pathname 320236 /path/to/file

Here you can also check the contents of deleted files with cat . (NOTE: You can also restore here if necessary).

Great article about it here .

+5
source

Thanks for your comments and answers. debugfs seems like an interesting solution for the initial requirements, but it is a bit redundant for the simple and easy solution I was looking for; if I understand correctly, the kernel must be built with debugfs support, and the target directory must be in mount debugfs . Unfortunately, this will not work for my use case; I should be able to provide a solution for existing "core" kernels and directories.

As this seems almost impossible, I was able to discuss and relax the requirements down to listing the number of files that were recently removed from the directory, recursively, if possible.

This is the solution I completed:

  • A simple find sent to wc to count the initial number of files in the destination directory (recursively). The result can easily be saved in a shell or script variable without requiring write access to the file system.

DEL_SCAN_ORIG_AMOUNT=$(find /some/directory -type f | wc -l)

  1. Then we can run the same command later to get the updated number of files.

DEL_SCAN_NEW_AMOUNT=$(find /some/directory -type f | wc -l)

  1. Then we can save the difference between the two in another variable and update the original amount.

DEL_SCAN_DEL_AMOUNT=$(($DEL_SCAN_ORIG_AMOUNT - $DEL_SCAN_NEW_AMOUNT)); DEL_SCAN_ORIG_AMOUNT=$DEL_SCAN_NEW_AMOUNT

  1. Then we can print a simple message if the number of files has decreased.

if [ $DEL_SCAN_DEL_AMOUNT -gt 0 ]; then echo "$DEL_SCAN_DEL_AMOUNT deleted files"; fi;

  1. Return to step 2.

Unfortunately, this solution will not report anything if the same number of files were created and deleted during the interval, but this is not a big problem for my use.

To get around this, I would have to store the actual list of files instead of the sum, but I could not do this work using shell variables. If anyone could understand this, I would really help me, as it would meet the initial requirements!

I would also like to know if anyone has comments on one of two approaches.

0
source

More articles:


All Articles