Directory is missing

[mrk_1]

Hi All,

Some of the important directory is missing on hp-ux box. As I am having a root privilege, How could find out who has deleted those folder?
And Is it possible to take back of this folder now?

Thanks.

[Ivan Krastev · Accepted solution]

Find what directories were deleted.
Check for latest backup and restore it or do a full restore from Ignite.

Check history file(s) for 'rm' commands.


regards,
ivan

[Kenan Erdey]

Hi,

if you know when it's deleted check logins with last -R and check IP's. if you have backup or ignite-backup you can recover. if these files are binaries, libraries etc you can copy files from an identical server.

Kenan.

[James R. Ferguson]

Ram:

> How could find out who has deleted those folder?

The word is "directory" in UNIX. You might examine any scripts that you recently modified. There are safe ways to code and their are unsafe ways. Of course, the damage may have been done at the command line. You could try examining your shell history.

> And Is it possible to take back of this folder now?

Without knowing what was deleted, the answer varies. Was it just a directory? (then recreate it). Was a directory and its files deleted? (then a good backup may be appropriate to restore (partially)). Does it really matter? (then maybe this is a good lesson).

UNIX (and LINUX) isn't that other operating system. There is no "recycle bin". UNIX is designed to do whatever you tell it to do without fuss.

Regards!

...JRF...

[MarkSyder]

There is another possibility: is one of your discs not available? What is the result of

ioscan -fnC disk

?

If you have a bad disc, I hope you have a good backup.

Mark Syder (like the drink but spelt different)

[sreekanthtm]

Permision is another factor, which can cause this issue. Are u sure, that you have root privilage. Please login as root and confirm it.


Which directory got deleted? Is it a system directory OR data? Check the history of commands, may be accidentally deleted the files or wrong command.

[mrk_1]

Thank you all for the quick response.

When I issue the command last -R, it response that, pid exceeds MAXPID: wtmp file corrupted.
I tried this in root user.

I remeber the folder name. Is not a system directory, Its a data only. But I dont know where I have to check the backup of this folder. I am not sure abt ignite backup.

Please help me out..

Thank you..

[Ganesan R]

Hi,

Have restore from last good backup is the only way to restore if it is really missing. If directories or deleted by some script then history also won't be able to provide the details.

Just to confirm ensure it is not NFS mount and unmounted by someone.

Thanks.

[MarkSyder]

If it's not a system directory it won't be on an ignite backup. What do you use for data backups? Data protector? Fbackup?

Mark

[OldSchool]

again, it's going to depend on the kind of data.

if it was part of a database structure, then your going to have to recover the db to the last consistent backup. if it was simply "storage space" for documents, then it might not matter at all.

if it was system config information, then it needs to come off a backup tape.

without information as to what was actually stored there, its all just a guess.

you *do* have backups, right?