topic Re: Deleted Files in Operating System - HP-UX

Deleted Files

Amiel Tutolo — Thu, 07 Oct 2004 09:29:01 GMT

I have some files that were deleted 2 days ago and I am trying to track down who or what did it. Is this logged somewhere on the system? This is on an 11i system. Thanks for your help in advance.

Re: Deleted Files

RAC_1 — Thu, 07 Oct 2004 09:34:15 GMT

You may get what you want?? Have you set the auditing?? (setting auditing will require the system to be in trusted mode)

If you have not, then you may look at at the $HOME/.sh_history files of all users. (that too if .sh_history has been set)

Anil

Re: Deleted Files

John Payne_2 — Thu, 07 Oct 2004 09:36:03 GMT

probably not. Where these files only writable by root? If so, do you have a policy that people have to 'su' to root to become root? If so, then you can go to the sulog to see who became root.

If you know when this happened, you 'may' be able to go see who logged into the system near that time. (Depending on your system, of course) try typing 'last' to see if you get a list of people logged in then. (May not get it if lots of people log in here.)

/var/adm/syslog/syslog.log would give you logs with users if you have logging enabled for inetd. (inetd -l) Then you should get a host or IP adress that the user came from.

Good Luck

John

Re: Deleted Files

Amiel Tutolo — Thu, 07 Oct 2004 09:39:14 GMT

This system is not a trusted system. Also I think the delete was done by a windows user through a CIFS share.

Re: Deleted Files

Rick Garland — Thu, 07 Oct 2004 09:40:44 GMT

In checking the .sh_history files of users, hope that it is setup and working. Also hope that the user (whoever it might be) has not more commands than the HISTORY is setup to save. Usually I see this as 500.

As an aid that might help narrow the search or prevent future occurrances, how are the perms and owners set for these files/directory?

If the perms are set then who has the access to do this function in this area?

Re: Deleted Files

Gerhard Roets — Thu, 07 Oct 2004 23:56:57 GMT

Hi Amiel

If it was through a CIFS share the odds is the process who deleted it would only show the cifs user. So if this user was attached as guest it would most propably just show the guest user account.

If you do not ave auditing turned on the odds is you will nto find it except for the chance of the history file as stated above, but CIFS does not have a history file.

Regards
Gerhard

Re: Deleted Files

Yogeeraj_1 — Fri, 08 Oct 2004 02:01:03 GMT

hi,

as a last recourse, if you have little number of users, you can use the "last -R" command to check the last logins of users...

good luck!

regards
Yogeeraj

Re: Deleted Files

Darren Prior — Fri, 08 Oct 2004 04:23:22 GMT

Hi,

If it was deleted through CIFS and you have set the CIFS logging at a high enough level, then I'd suggest you grep the files in /var/opt/samba for the deleted filename.

regards,

Darren.

Re: Deleted Files

Amiel Tutolo — Fri, 08 Oct 2004 08:44:34 GMT

Thanks for your help. This was deleted by a CIFS user and the logging was not high enough to catch. They finally admitted to it.