How to find which files and folders were deleted recently in Linux?
Matthew Martinez 
I am having one particular folder (/home/sam/officedocuments) which is having hundreds of folders and files.
I think I deleted some files and folders by mistake but I'm not sure.
How to find which files / folders were:
- deleted recently in Linux?
- changed recently in Linux?
I just want to know which files and folders were deleted. Recovering those deleted files and folders is not important for me.
OS: CentOS
23 Answers
…changed recently in Linux?
Use find to search by modification time. For example, to find files touched in the last 3 days:
find /home/sam/officedocuments -mtime -3
For "older than 3 days", use +3.
…deleted recently in Linux?
Pretty much impossible. When a file is deleted, it's simply gone. On most systems, this is not logged anywhere.
4You should probably install Inotify Tools.
then you can use the inotifywait command to listen for events happening for the specified directory.
Specifically if you want to watch for deleted files and folder use this
inotifywait -m -r -e delete dir_nameand log this output in some file.
Hope this solves your problem
4Linux does not generally ask for confirmation before removing files, assuming you're using rm from the command line.
To find files modified in the last 30 minutes, use touch --date="HH:MM" /tmp/reference to create a file called reference with a timestamp from 30 minutes ago (where HH:MM corresponds to 30 minutes ago). Then use find /home/sam/officedocuments -newer /tmp/reference to find files newer than the reference.
If you deleted files using a GUI tool, they may still be in some kind of "trash can". It depends on what you're using for a desktop environment. If you used rm from the command line, then try one of the utilities mentioned in this answer. (Hat tip to @Sampo for that link.)
