0

Hi we are using the S3 on AWS. and there are several people who have access to that box, however, everyone has to log in as the same user/ubuntu.

I was doing some work, zipping a big file using nohup:

nohup gzip monitoring_result &

Then when I came back, the original file and the zipped file are all gone!!!!! That is a big issue to me and when I pull the history, clearly I did not do anything stupid to accidently delete those files. And I am wondering how could I find out who deleted it or what happened to that file?

I have sudo on that box.

Improve this question
3
  • Why don't you create seperate uses this way you can keep track of who does what?
    – Ramhound
    Commented Oct 16, 2013 at 17:12
  • I will do it. I am wondering is there still anyway that I can find out who did it?
    – B.Mr.W.
    Commented Oct 16, 2013 at 17:14
  • If multiple people were logged in as the same user any log file created, wouldn't tell you WHO did it.
    – Ramhound
    Commented Oct 16, 2013 at 17:16

1 Answer 1

Reset to default
1

If all people were logged in as the same user, then you have no chance to find out, who it was, because for the computer, everybody is the same because of the same user-account they used.

I would highly recommend you, to set different users for these people.

Maybe you have a chance to recover your file. You could use for example TestDisk. You should use this tool with a live-cd to recover your file.

Also foremost is a good command-line tool.

Download:

sudo apt-get install foremost

Direct Downloadlink

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .