Search code examples
centoscpanelwhmcomputer-forensics

How to know who and when files and folders have been deleted in CentOS?


Some files and folders have been deleted on a web server, How to know how delete them and when? I checked the Raw Access logs but I couldn't find some thing could help.

thanks


Solution

  • Use find to search by modification time. For example, to find files touched in the last 3 days:

     find /home/user -mtime -3
    

    For "older than 3 days", use +3

    +++++++++++++++++++++++++++++++++++++

    second command

    history
    

    .