thanks for all speedy replies
As I thought there is very little you can do !
************original message*************************************
hello managers
somebody deleted a whole directory either yesterday or today.
1) Is there some way of finding out who deleted this directory
2) Any way of recovery other than backup.
**********************************************************************
1)
opt 1) You can check the .<shell>_history
No luck here !
opt 2) you could look in the parent directory for the modification date
(assuming no other files or subdirectories were created).
unfortunately in my case there was !
Then use last command to find who was logged on at the time, and take
the intersection with those having write access to delete it, and
interview them one by one.
opt 3) Or if directory was protected for general users, find from auth.log
if
anybody did a "su" at the time ...
2) Nope!
Darrell King
SysAdmin
6142430
darrellk_at_apion-ti.com
Received on Fri Oct 16 1998 - 14:04:35 NZDT