Deleted Files

[Amiel Tutolo]

I have some files that were deleted 2 days ago and I am trying to track down who or what did it. Is this logged somewhere on the system? This is on an 11i system. Thanks for your help in advance.

[RAC_1]

You may get what you want?? Have you set the auditing?? (setting auditing will require the system to be in trusted mode)

If you have not, then you may look at at the $HOME/.sh_history files of all users. (that too if .sh_history has been set)

Anil

[John Payne_2 · Accepted solution]

probably not. Where these files only writable by root? If so, do you have a policy that people have to 'su' to root to become root? If so, then you can go to the sulog to see who became root.

If you know when this happened, you 'may' be able to go see who logged into the system near that time. (Depending on your system, of course) try typing 'last' to see if you get a list of people logged in then. (May not get it if lots of people log in here.)

/var/adm/syslog/syslog.log would give you logs with users if you have logging enabled for inetd. (inetd -l) Then you should get a host or IP adress that the user came from.

Good Luck

John

[Amiel Tutolo]

This system is not a trusted system. Also I think the delete was done by a windows user through a CIFS share.

[Rick Garland]

In checking the .sh_history files of users, hope that it is setup and working. Also hope that the user (whoever it might be) has not more commands than the HISTORY is setup to save. Usually I see this as 500.

As an aid that might help narrow the search or prevent future occurrances, how are the perms and owners set for these files/directory?

If the perms are set then who has the access to do this function in this area?

[Gerhard Roets]

Hi Amiel

If it was through a CIFS share the odds is the process who deleted it would only show the cifs user. So if this user was attached as guest it would most propably just show the guest user account.

If you do not ave auditing turned on the odds is you will nto find it except for the chance of the history file as stated above, but CIFS does not have a history file.


Regards
Gerhard

[Yogeeraj_1]

hi,

as a last recourse, if you have little number of users, you can use the "last -R" command to check the last logins of users...

good luck!

regards
Yogeeraj

[Darren Prior]

Hi,

If it was deleted through CIFS and you have set the CIFS logging at a high enough level, then I'd suggest you grep the files in /var/opt/samba for the deleted filename.

regards,

Darren.

[Amiel Tutolo]

Thanks for your help. This was deleted by a CIFS user and the logging was not high enough to catch. They finally admitted to it.