General :: Samba Deleted Files Forensics?
May 10, 2010
I'm on the horns of a dilemma. Someone of the local network deleted a directory from the public share and I want to find who did this. I have searched the smbd logs but no answer till now. How can I easily do it ? I know the date but the logs show nothing, I found that when I create a file/directory on that share samba logs this event. So, for deleted files/folders there must be some notes somewhere ... The thing is I don't really know for what word to grep.
View 1 Replies
ADVERTISEMENT
Sep 16, 2010
How to find detail logs of deleted file or folder from Samba Server?
View 1 Replies
View Related
Jul 12, 2010
I use a CentOS 5.4 machine as a Samba file server for a WinXP SP3 box. I noted that when I deleted files under the Samba server from WinXP, there is no trash can for them. What I delete is lost for good. Is there a Samba config setting that puts deleted files into a trash can?
View 2 Replies
View Related
Feb 10, 2010
After what feels like weeks have tinkering around trying to get a Samba file server set up, I've finally given up! I have 4 drives and 2 groups:
1) Dev - Available to all users in both groups (normal and admin)
2) Misc - Available to users in admin group only
3) Admin - Available to users in admin group only
4) Accounts - Available to users in admin group only
Drives 1 and 2 are working fine, with the correct access rights. Drives 3 and 4 can be browsed by admins only, but no changes can be made at all - files & directories can't be renamed/moved/deleted. What is most confusing is that Drive 2 is set up exactly the same as Drives 3 and 4. The process I went through to get them working:
[Code]...
View 2 Replies
View Related
Apr 16, 2011
I was working on my Ubuntu lab machine and unconsciously deleted the project files I was working on. I have been working on the project since last 10 days now. Is there a way to restore the files? I do not have sudo access. I was working in my home directory which is served by a common file system (serving all the lab machines).
View 1 Replies
View Related
May 4, 2010
I am looking for an application I used in 2001.It was a curses application that displayed devices or files in hexadecimal format, and allowed searching through them and other functionality.
View 2 Replies
View Related
Nov 19, 2010
newbie changing to Linux, but not comps.as I said in newbie forum, putting them together since mid 80's w/5150's. that said most exp is old dos command line and commodore 64 basic. our economy here in USA causes change for many of us. I am now reading CompTIA study guide for Linux+ certification by Robb H. Tracy, pro Linux administration by James Turnbull,Peter Lieverdink, and Dennis Matotek. I have downloaded and installed PcLinuxOs, Fedora, SuSe.(three separate disks) have Linux Mint, Ubuntu, on cd. I also have Helix, DEFT, FIRE, FCCU, and Live Forensics Toolkit for Windows. because of pending legislation in our state and current or pending in others, taking classes@community college for private investigator. end goal?: Linux Systems Administrator/security/private investigator specializing in forensics?as I learn I'll probably install a server version on 1 of my drives and ask some of you to use it to work with/hack me/give me help in general.
View 5 Replies
View Related
Jun 7, 2010
I searched the forum with various terms and didn't find anything, so my apologies if this is a common and/or newbie problem.It seems that when I have a USB driveplugged in to switch the files around, those that I delete are still taking up space. I first noticed it with a Chinese MP3 player and thought it was the player being crappy. I could still play all the songs that were supposedly gone. Today, I noticed it with a little thumb drive that I've had for years. I plugged it into my husband's computer running winXP, and the files showed up in a weird, unusable form. I was able to delete them for real.
View 4 Replies
View Related
May 1, 2010
Ubuntu 9.10 I recently deleted some files. I would like to know are the files kept in a directory? Like in windows recycle bin. I would like to know where these files are?
View 2 Replies
View Related
Apr 18, 2010
My laptop has two os. one is windows vista. and other is Ubuntu. I am currently on ubuntu system, this is my primary OS.There are 4 partitions of my hard diskWindows OSLinux(Ubuntu OSData Now the problem part. The data partition is NTFS. I have mounted this partition on the location /media/windrive-a under ubuntu OS.A little while back i decided to delete the mounting of the data partition and i fired command rm -r /media/windrive-a/. To give me a shock; all my data on data drive is gone.Now, I know this is not the command to remove mounted partition. But I have committed the wrong. Is there any way i can get my data back. These are very important data for me.
View 2 Replies
View Related
May 3, 2011
i lost below mention file in my appache server,how i can recover libphp5.so mod_actions.so
View 2 Replies
View Related
Dec 27, 2010
is there any way to save deleted files in server any path like recycle bin in samba server. because the samba user delete file and folder by mistake.
View 4 Replies
View Related
Feb 26, 2011
Im having problems getting the httpd service to start. Instead of clearing my log files in var/log i accidently did a force remove command on all the log files within the log directory. I'm not unable to start my httpd service and of course unable to check my log files to see whats what.
View 9 Replies
View Related
May 3, 2010
My main storage partition got full, so I'm deleting files to make room. However, df -k keeps reporting no space available on that partition (/disk). Here's the output of the command several minutes apart while another process is deleting a 30G of space:What can I do to make the space available immediately?
View 4 Replies
View Related
Oct 22, 2010
There are some files on my external disk drive that are corrupted and not identifiable. How can I recover these files?
View 1 Replies
View Related
Sep 4, 2010
Some a$$ hack me MySQL and deleted all my databases, I have older copies on my system, but is there a way that Ubuntu server can recall or recover deleted MySQL database files ?
View 8 Replies
View Related
Apr 2, 2010
I need to recover some folders and some files from my CentOS 5.3 X86_64 linux machine ext3 partition after I have deteled them with rm -rf command. After I have deleted the files (*.exp extension) and folders with rm -rf command, I have written a big archive 70GB on the same partitions but in a different path. I know that in windows if I do that, there's no way I can bring back the deleted files, 'cause the OS writes the information in the same cluster and therefor I can't bring back the files. I hope you guys understand what am I saying.
what program (that knows all extensions, or dosen't read a specific extension/extensions) can I use in order to get the date back ? I have used foremost and it worked, but this programs knows only specific extensions, like exe, jpg, avi, mpeg, etc and not my *.exp extension. The foremost program worked perfectly, but it dosen't know the *.exp extension that I need, in order to get the data back that has that extension.
View 6 Replies
View Related
Apr 27, 2011
i manage to delete some files from the system. now i need to recover them.. i know the inode # (through ext3undel) and also the size.Quote:Unfortunately, we cannot automatically obtain the name of a deleted filefrom Unix file systems - since the connection between the iNode (whichholds the MetaData, including the file namee real data is droppedon deletion. However, we can obtain a list of names from the deleted files.How can i use this information to recover the files?Also can i search the text from a partition? (file don't exists). As i need figures
View 3 Replies
View Related
Mar 29, 2011
I created a script to move files to a "trashbin" This is my code:
Code:
mv $1 /home/giovanni/trashbin
echo "$1 Deleted"
[code]...
View 13 Replies
View Related
Sep 9, 2010
is there any way to recover deleted files and folders in redhat9.because one of my user delete one folder through samba.please advise me or any other recover tools.
View 4 Replies
View Related
Jun 10, 2011
I get a SD card. Put in the SD reader. It's empty. I go to my super-important-pictures-to-a-monthly-relatory folder and select all files. Select them for MOVE. Paste them on the SD card. When the move/paste process is finished, i click on the "Eject" button on top of the SD card name. Card's ejected. I can't access the card anymore. I take out the card and put on my other computer. From 300 pictures, there are only 10 available, the remaining ones are there, but with 0bytes and unrecoveable. I panic. I go back to my main computer, my pictures are not there anymore. The pictures were on the Home folder. I panic again. I reset the computer and boot on the LiveCD. I install foremost, scalpel, photorec and about everything till my USB drive complains about being filled up. I run everything and I can't recover my files. I'm in the danger of getting fired. Things like that makes Windows sounds more appealing. When you securely remove a pendrive, things get REALLY pasted there before screwing everything up with a removal.
View 8 Replies
View Related
Aug 22, 2011
Is there like EasyRecovery for Linux? Free open source command-line based software strongly preferred.Expecting something like:
$ fat32_recovery --some-arcane-options dump.img dir/
Recovery in progress...
~ILE1.TXT -> dir/XILE1.TXT
[code]....
View 1 Replies
View Related
Feb 21, 2011
I have a vsftp server running, and we have problems sporadically where people (not the person who uploaded the file) cannot delete files uploaded from OSX machines. We never have this problem with files uploaded by PCs. Anyone ever heard of this or know what I should check? The users uploading the files all belong to the same group. Also, I think if you log in to the FTP server with another OSX machine, it will let you delete them. I'm looking at the folders now, they have drwxrwxr-x. When i try to delete them from a PC, it gives me a 550 Remove directory operation failed.
View 14 Replies
View Related
Dec 5, 2010
I have managed to write a bash script that moves files to the recylce bin instead of being deleted. Then (with a bit of assistance) wrote another bash script that deletes the files from the recycle bin. Now I need to write one that will restore the files preferably to their original location? I am very new to linux and stuggling with where to even begin...any ideas? There seems to be some advice about creating a cloning tree, but I've never heard of them?
View 8 Replies
View Related
Mar 9, 2011
I have a Kingston 8gb Datatraveler that has been giving me troubles lately. For some reason after I delete files from it it still shows up as full and the files are shown in the hidden trash files. How do I get rid of these files? I can't delete them as they just show back up. Also, I tried to format the drive with gparted and it won't unmount. When I right click and select information, at the bottom it says: Unable to find mount point. Unable to read the contents of the file system. Because of this, some operations may be unavailable.
View 1 Replies
View Related
Jan 13, 2010
On a KDE4 environment after downloading some music from rapidshare with JDownloader the archives self-extracted with the symbol in some of the file names. Those files couldn't be renamed or deleted, the file manager said that the files didn't exist - very weird. The files should have had some swedish characters in their file names. Now I'm stuck with those files on my machine. Anyone knows how to get rid of them?
View 2 Replies
View Related
Apr 10, 2011
I am trying to find Helix 1.8 distros which no sites currently have them but I am able to find them just can't download them. It appears to be "empty" on the server to which the Helix ISO distros is hosted at. I have tried many sites that I found has Helix 1.7, 1.8, and 3.0. 3.0 does not come with some features that 1.8 does, like Endeavour File Management, so that I can go to Forensics > Retriever. I currently have Helix3 Pro, which does not have, Forensics program > Retriever. Frankly, 1.8 does Endeavour File Management build in. So I am able to access Forensics > Retriever.
View 1 Replies
View Related
Jun 17, 2011
Is there anything that could betray the time the USB memory drive was last removed ? I can't find it and the time would help me pinpoint what happened to it.fstab file last access time or something like that ?
View 4 Replies
View Related
Mar 19, 2010
Ok, this is a complicated one, and possibly not entirely a linux question, but here goes-
I have a Synology server, set to backup to an external USB disk. As I understand it this disk is formatted as ext3.
The server recently crashed, so I need to get the data off the USB disk.
Weird thing 1: if I used an ext3 reader for Windows, then I can only see directories on the USB disk, no files. Yet if I mount it back on the (now crashed, but still just about bootable) Synology, then I can see all the files just fine.
Since I can see the files on Synology I figure the Windows ext3 reader is faulty. So I copy all the files to a spanky new QNAP NAS. Telnetting into the NAS I can see everything is present and correct and all the data is there. Great!
Weird thing 2: If I try to access the data via a Samba share, I can't see any of the files. Only directories!
Weird thing 3: I tried to make it all completely open by chown to my user and the "everyone" group, and then chmod uga+rxw *. This made no difference.
Weird thing 4: If I select "show hidden operating system files" in Windows then all the files appear.
Are there some weird "extra" permissions that Synology are using? If so how can I get rid of them? Anybody have an idea what is going on?
My worst case is I'll have to boot the Synology back up and copy the files via that, but I'd like to know whats going on. Oh and black mark to Synology here for making a backup that is hard to use on anything but the original system.
Thanks!
View 5 Replies
View Related
Apr 6, 2011
I am using samba from a windows client to put some rights access on FTP server on Linux. created a folder and I want that a user can write in that folder (put a file for example), but, once he did that, he can't delete or rename the file.
View 5 Replies
View Related
