4

I'm working on Ubuntu 13.04. yesterday from a Windows 7 partition, I accidentally deleted many files. I deleted by pressing shift-del.

Is there any way to know the name of the files that got deleted? If I'm able to get the names, I will make out how important the files are? If they are important I will try to recover or else I won't try. With no idea on whether log files can reveal that, I checked syslog file generated for that day but I couldn't find any information regarding that.

derobert
  • 109,670
Ravi
  • 3,823

1 Answers1

3

No there isn't generally any log that is maintained that keeps track of what files were deleted. About the only thing I can think of outside of trying to undelete the files using something like this Q&A: undelete files from local fileserver, is you could take a look at your system's locate command. It keeps a full list of all the files on a system, it's typically run nightly via cron, so you might find a list of the file names there, assuming you know what directories they were in.

Example

To get a list of all the files in my $HOME directory.

$ locate /home/saml | head -5
/home/saml
/home/saml/.Fontmatrix
/home/saml/.ICEauthority
/home/saml/.Trash
/home/saml/.VirtualBox

UPDATE #1

This approach would work so long as 2 conditions are met.

  1. The Windows 7 partition was mounted during the window of time that the cronjob that runs the indexing of the HDD (typically this: /etc/cron.daily/mlocate). This task runs daily, so if the partition is mounted one day but not the next, the data for that partition will get erased.
  2. The mlocate crontab entry hasn't run yet, with those files now erased.

NOTE: This option is what I would consider a last ditch effort, something before resorting to actually attempting to recover the files using one of the many undelete methods covered on Unix & Linux. You have a very small window of opportunity to get a listing of files that were on your system from the mlocate database but have been deleted.

Community
  • 1
slm
  • 369,824
  • 1
    Great idea, +1! Perhaps the OP can compare the output of locate with the output of locate --existing and work from that. – terdon Jan 05 '14 at 15:59
  • @terdon - thanks, he'll have to work quickly though, I think the next time the locate cron runs the data will get lost. – slm Jan 05 '14 at 16:00
  • Yup, but that depends on the settings in /etc/cron.daily/mlocate, might even be earlier. – terdon Jan 05 '14 at 16:03
  • I ran locate /boot | head -5. If it had to output the files under /boot they why it gave outputs under /etc. For ex.: one line of output is /etc/default/bootlogd. In my case, as it was Windows partition which always needs to be mounted manually, I ran the command locate /media/ravbholua/100EECEB0EECCB34 but it returned no output. – Ravi Jan 05 '14 at 17:14
  • @Ravi - it is pattern matching "/boot" in the string "/etc/default/bootlogd". If locate found nothing then this idea though valid is a dead end since the data for /media is likely gone now. – slm Jan 05 '14 at 21:51
  • @Ravi - with this approach not helping you, I think you're only other option is to undelete the files using an appropriate method for NTFS. There isn't any other way that I'm aware of to get a listing of files. – slm Jan 05 '14 at 21:59