I haven't been able to find anything on the 'net about this: when running "rkhunter --enable all", I get this warning:
Code:
However, when I navigate to the gvfs-metadata folder, the home file is there, 124.8Kb in size, of unknown type and gedit can't open it. The file in /tmp/, on the other hand, doesn't exist.
Why is Terminal using a deleted file, and why is the home file being reported as deleted when it isn't?
I use XBMC a lot and recenty i have been trying to download movies i have d/l using SABNZBDPLUS. I noticed my 320GB getting low so i tried deleting the files within the folder itself but got this message "Cannot move file to the deeted items folder, do you want to delete permanently?". Anyway i tried to delete but i guess it would not also the main folder had a lock icon on it.
So i read somewhere you can use nautilus in the terminal and once i navigated to the folder in question i pressed the delete key on my keyboard. The file is not in my trash can and i dont think is permenantly deleted as my disc space has not been reduced.
I don't know whether this is a bug or feature. But I find the fact that the Trash in Gnome doesn't delete trashinfo files a security liability.
I found in ./local/share/Trash/info thousands of .trashinfo files named exactly like the files deleted and each one contains the date of deletion.
I thought when I empty the trash bin every record of the files were removed. I understand that there are forensic ways to recover data and rm isn't very secure with journaled file systems, but forensic recovery isn't 100% and if the disk is written over several times the data is gone.
Here you have a permanent list of all the files you've deleted, without you knowing and the dates of deletion. IMO that's too much information.
Update: Weird after removing the files manually and then trying to delete files again using the trash I found no .trashinfo files, this time. So they were probably leftover files, but they didn't have a different owner/permission. Could this have been an issue and now fixed? (running Lucid)
I was using dd if=/dev/zero of=/dev/user name/wipe.conf however i got a message that my hard drive is full.
lots of this is scary - dangerous. what is the best way to fill in random or zeros in deleted files without the hard drive filling up ?
How do I erase my hard disk of "Deleted Files"?I mean how do I make "Deleted Files"-----> "Non Recoverable"?
View 3 Replies View RelatedI searched the forum with various terms and didn't find anything, so my apologies if this is a common and/or newbie problem.It seems that when I have a USB driveplugged in to switch the files around, those that I delete are still taking up space. I first noticed it with a Chinese MP3 player and thought it was the player being crappy. I could still play all the songs that were supposedly gone. Today, I noticed it with a little thumb drive that I've had for years. I plugged it into my husband's computer running winXP, and the files showed up in a weird, unusable form. I was able to delete them for real.
View 4 Replies View RelatedI get a SD card. Put in the SD reader. It's empty. I go to my super-important-pictures-to-a-monthly-relatory folder and select all files. Select them for MOVE. Paste them on the SD card. When the move/paste process is finished, i click on the "Eject" button on top of the SD card name. Card's ejected. I can't access the card anymore. I take out the card and put on my other computer. From 300 pictures, there are only 10 available, the remaining ones are there, but with 0bytes and unrecoveable. I panic. I go back to my main computer, my pictures are not there anymore. The pictures were on the Home folder. I panic again. I reset the computer and boot on the LiveCD. I install foremost, scalpel, photorec and about everything till my USB drive complains about being filled up. I run everything and I can't recover my files. I'm in the danger of getting fired. Things like that makes Windows sounds more appealing. When you securely remove a pendrive, things get REALLY pasted there before screwing everything up with a removal.
View 8 Replies View RelatedI have a Kingston 8gb Datatraveler that has been giving me troubles lately. For some reason after I delete files from it it still shows up as full and the files are shown in the hidden trash files. How do I get rid of these files? I can't delete them as they just show back up. Also, I tried to format the drive with gparted and it won't unmount. When I right click and select information, at the bottom it says: Unable to find mount point. Unable to read the contents of the file system. Because of this, some operations may be unavailable.
View 1 Replies View RelatedOn a KDE4 environment after downloading some music from rapidshare with JDownloader the archives self-extracted with the symbol in some of the file names. Those files couldn't be renamed or deleted, the file manager said that the files didn't exist - very weird. The files should have had some swedish characters in their file names. Now I'm stuck with those files on my machine. Anyone knows how to get rid of them?
View 2 Replies View RelatedI was working on my Ubuntu lab machine and unconsciously deleted the project files I was working on. I have been working on the project since last 10 days now. Is there a way to restore the files? I do not have sudo access. I was working in my home directory which is served by a common file system (serving all the lab machines).
View 1 Replies View Relatedi was trying to edit my firefox apparmor profile. I used aa-genprof, and accidentally closed the terminal before the program was finished. Firefox wouldn't load properly after that whenever it was enforced. I uninstalled and reinstalled the profiles, but it didn't help.Finally I deleted the files for the profile itself ... now it will not reinstall them..I marked all the apparmor packages for complete removal and then reinstalled them but it will not put the original firefox profile back in.
View 2 Replies View RelatedI have carefully made daily backups using rdiff-backup, so in the case of needing to restore I can do so.
But I deleted a directory yesterday, and made a backup in the evening. Therefore, the directory is not in the latest mirror, but in the incremental backup from yesterday.
Now I need to restore the directory. But I cannot figure out how to!
I can see the directory in yesterday's incremental backup; i.e., the following works:
Code:
Where [backupdir] is the backup (mirror) directory, and [nameofdir] is the name of the directory I'm trying to restore.
So, I have tried to restore. This is the type of thing I have tried:
Code:
Where to-restore.lst holds the name of the directory to restore (in rdiff-backup's format) and [restoredir]is where I want the restored directory to go to.
But, I get errors like:
Code:
Useful file specifications begin with the base directory or some pattern (such as '**') which matches the base directory. Well, obviously the file specification doesn't exist in the [restoredir]. That's because I'm trying to restore it! If I try to create an empty directory first, it complains:
Code:
How do I restore a deleted directory from a previous day's backup to a designated destination?
Why is that certificates need to be revoked with openvpn?I simply removed them from the keys folder but everytime the client connects it just places the certificates back into the keys folder itself?! Should that be possible?
Secondly, I have a problems etting the revoke command.Is there a known setting on the openssl.cnf file that might cause this?
[root@server]# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
[root@server]# ./revoke-full client2
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
error on line 282 of config file '/etc/openvpn/easy-rsa/2.0/openssl.cnf'
21368:error:0E065068:configuration file routines:STR_COPY:variable has no value:conf_def.c:629:line 282
code....
Following bad instructions too fast to reset the default keyring password I deleted the file .gnome2/login.keyring ! I can still login and get to a terminal and do instructions from there. I can also still login with root and a guest account. But my desktop is just blank and I can't, even as a root, access my files.
View 5 Replies View RelatedMy Linux is Fedora release 13. I found there are a few users created not by me. I am not sure if the system got hacked somehow. Then the hackers created these users, i.e. (1) oracle, (2) exim, (3) test, (4) cox. I tried to delete all of these four users by using "usrdel" command but the system said "I cannot delete these users as the users are logging in". If my system got hacked ?? or these users are created by the system itself?
View 8 Replies View RelatedI work for a seismic company that has recently experienced a security issue. Because we have an isolated network that is used for HPC work we have a very open security structue ie password less accounts rsh rlogin etc. We had, seemingly,a user that has maliciously deleted another user's files but I still haven't figured out how. So far I have been able to prove that this user has remotely logged into another host under that user's account... or at least that their workstation did. The /var/log/message file shows logins from their workstation as that user multiple times durring the times that these files were being deleted. There are wildcard searches for these files in the history in this host. There is a vi session initiated on this host for a file called delme (delete me) and then a chmod +x for this file. and then a deletion of this file (rm delme). Funny things: this user has no business in this acct. this user was bounced off the other host (permission denied) when trying to log into the other host and then as root logged into the other host as the other acct. repeatedly... ie. rsh -l xxx (permis den) then as root rsh -l xxx (logged in) why not su xxx and then rsh? password less acct?! why use root privs (which they sholuld not have) to log into a passwd less acct? Can't see any remote logins to their workstation from elsewhere. can't find smoking gun. no execution of delme script or any other rm /*/xxx/* sort of command that proves when file deletion of striped files happened?!
changing root passwd soon.need proof that no remote logins to a CentOS 5.3 workstation could be responsible.
Could mean someone gets fired.how can I be sure that no other users logged into this machine and then into another machine for sure?
Recently, I started protecting all user-accessible filesystems on my Sidux desktop machine with LUKS. Before that, I would regularly erase traces of deleted data, and I wonder if this is still necessary.
It would be most valuable to me to be pointed towards a good introductory article on the underlying mechanics of LUKS and cryptsetup, as there are a few more minor questions to be answered. Unfortunately, I lack the necessary mathematic and cryptographic background to understand scientific papers.
I did an update on one of my main computers last night. while in the update it reported "293 files to be REMOVED and 1 to be added".... it cranked away for some time and now all I get is a text login to my desktop. There is no graphics anymore. just a command line.
Is there any way to make it boot the way it used to or will I have to reinstall without formatting my hard drive (if so, how do I do this?)? I have checked and all my personal data is in tact. I was running Hardy Heron with 5.4 gigs of an 80 Gig HD free and 2 Gigs of RAM with an AMD 5000+ processor.
The question is simple. I had a FAT external pendrive with some thing of it, and I've stupidly shift-del eted 2 folders that now i needed. Could be possible to retrieve the deleted files?
View 5 Replies View RelatedI need to get back two avi movie files but I've deleted hundreds and any recovery might try and drop them back on my small hard disk and overwhelm it! I know the files include the word 'Archer' but I'm using Formost, which is very easy to use, but it doesn't seem to allow for the searching of specific files by name. I can recover by type ie, avi, jpeg, pdf.....
Are there any recovery programs that will list files in a table so I can pick the ones I want to recover or do a search in Terminal for my 'Archer' files?
Deleted a whole bunch of files, I have backed it up but it was from about 2 weeks ago and as I had added loads of stuff in the meantime I urgently need to recover the files.Ubuntu 9.10. Any and every file recovery program you know please.Preferably one that allows me to recover an entire directory, not just individual files, but it'll be fine if that is it.
View 9 Replies View RelatedIs there a way to deep clean the supposedly "empty" areas of HDD. I've found "shred" and similar tools by googling, but they allow either deleting a file or complete wipeout of a HDD. What I'd like to do is clean up what's left of already deleted files (which can probably be still "undeleted") on a live HDD (with useful data, which doesn't need to be destroyed).
View 5 Replies View RelatedI have accidentally deleted all the files in my /boot directory of my Lynx 10.04 64bits installation.
Is there any way I can manually reinstall them ? I need just to reinstall a kernel so I can reboot
Can I manually copy them from somewhere (CD, etc.)
Yesterday I accidentaly deleted all files from my desktop (with rm). Now I am looking for way how to recover them.
I tried to use scalpel to recover them which found many files (more than 800000 zip files). I stopped the process cause It would take ages. I would like to recover files only from desktop folder. Is this possible?
Is there some other good recovery program?
Using Ubuuntu 10.04.
Ubuntu 9.10 I recently deleted some files. I would like to know are the files kept in a directory? Like in windows recycle bin. I would like to know where these files are?
View 2 Replies View RelatedI have a lot of .pyc and .pyo files and I really need the space. I was wonder if I can remove them as I know python will create them automatically.At the moment, I need to make sure I have the space and only this files I can delete... should this be fine?
View 5 Replies View RelatedI tried to include new software sources for VLC and Wine. Something went wrong and the authentication keys didn't work right, and were producing errors of authentication.
In one moment of carelessness (other word for stupidity) I deleted all the authentication keys from the software sources and of course with all the updates I am getting that software cannot be authenticated.
I clicked on "restore defaults" but still it isn't working right. I tried for example to install "Filezilla" and I got a warning that software could not be authenticated and installation stopped.
Does anyone know how I can restore all the proper authenticating keys?
I accidentally permanently deleted a few files and I was wondering if there was a program that finds the files that were deleted and restores them?
View 4 Replies View RelatedIf I move a file to the trash,I can restore it later.But if I empty the trash,I'll be warned that I cannot recover the files if I proceed.Is this really true or are there Linux applications for recovering files deleted from the trash?Uhm...are the files deleted completely and unrecoverably or are there any traces left behind?
View 6 Replies View RelatedI have a problem to gain my hardisk size after deleting a large amount of files. i have root partition size with 196 GB. actual used size in that partition is about 70GB, with command df -h, the used size 139GB. I have no idea to find out where is the hidden files. this happend after I delete the large amount of files because the hardisk almost full. the file i have deleted is almost 60 GB size.
View 3 Replies View Related