Is there a UNIX command to list all recently removed files from a system

Accidentally a rm -rf command was launched to my root directory instead of current directory. I stopped file removing by Ctrl+C but some files has already been removed. Is there a LINUX command to list all recently removed files from the system to get the affected applications ?

Operating System: CentOS 6.3

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

*nix systems typically have a locate utility installed. It has a database, usually updated nightly, that has the names of (almost) all files on your system. Just run:

locate /path/to/dir/of/interest

and you should see a list of files that were in that directory as of the last database update. You can diff this against the current list.

Because it will be overwritten automatically with a new version, you might make a back-up copy of that database now. On debian-influenced systems, it is stored in /var/lib/mlocate/mlocate.db.

How to show missing files

1. Make a backup of the old database:

   cp /var/lib/mlocate/mlocate.db ~/old.db

2. Update the database. The command to do this may vary. On a debian-like system, try:

   sudo /etc/cron.daily/mlocate

3. Get the new and old file lists for your directory:

   locate -d ~/old.db /your/dir | sort >~/old.list
   locate /your/dir | sort >~/new.list

4. Get a list of all new and missing files:

   diff ~/old.list ~/new.list

Additional notes

• Not all files are listed in locate’s database. A configuration file, typically /etc/updatedb.conf, determines which files and directories are excluded.
• In the past I have used some version of locate that, by default, would only list files that still exist. If that is the case for your locate, you will want to turn that feature off.

Method 2

For arch I was afraid I accidentally deleted lots of files with a bad fin … | xargs rm -rf command format. John1024 thank you for the advice.

To simplify everything (for my web-directory /srv/http) I run this all in one line:

sudo cp /var/lib/mlocate/mlocate.db ~/old.db; sudo updatedb; sudo locate -d ~/old.db /srv/http | sort >~/old.list; sudo locate /srv/http | sort >~/new.list; sudo diff ~/old.list ~/new.list;

Make sure you replace /srv/http with your directory of concern.

and this displays the files that were changed. Thanks again!

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0