linux - How to list recently deleted files from a directory? -


i'm not sure if possible, list files deleted directory, recursively if possible.

i'm looking solution not require creation of temporary file containing snapshot of original directory structure against compare, because write access might not available. edit: if it's possible achieve same result storing snapshot in shell variable instead of file, solve problem.

something like:

find /some/directory -type f -mmin -10 -deletedfilesonly

edit: os: i'm using ubuntu 14.04 lts, command(s) running in variety of linux boxes or docker containers, or of should using ext4, , not have access make modifications.

you can use debugfs utility,

debugfs simple use ram-based file system specially designed debugging purposes

first, run debugfs /dev/hda13 in terminal (replacing /dev/hda13 own disk/partition).

(note: can find name of disk running df / in terminal).

once in debug mode, can use command lsdel list inodes corresponding deleted files.

when files removed in linux un-linked inodes (addresses in disk file present) not removed

to paths of these deleted files can use debugfs -r "ncheck 320236" replacing number particular inode.

inode   pathname 320236  /path/to/file 

from here can inspect contents of deleted files cat. (note: can recover here if necessary).

great post here.


Comments

Popular posts from this blog

yii2 - Yii 2 Running a Cron in the basic template -

asp.net - 'System.Web.HttpContext' does not contain a definition for 'GetOwinContext' Mystery -

wso2esb - How to concatenate JSON array values in WSO2 ESB? -