Is there a way to determine "who" deleted a folder?

[JP]

This isn't the end of the world since I maintain backups and my data is recoverable, but recently I had two folders full of files disappear.  I don't see that I could have done it, but maybe I did.  Another family member might have accidentally done it through an application (which I'm locking down now), but again, I would think it is unlikely.  I looked through the log, but nothing stood out and I'm not savvy enough to really understand what I'm looking at.  Ultimately, does UNRIAD keep some kind of log around when a file is deleted and provide some kind of source data that accomplished the deletion?   

[Squid]

19 minutes ago, JP said:

Ultimately, does UNRIAD keep some kind of log around when a file is deleted and provide some kind of source data that accomplished the deletion?   

There's the files within /var/log/samba, but I doubt they'd reveal anything.

 

What you'd want to do is check the logs for whatever application you think was used.

 

Or install the Recycle Bin plugin which will let you recover files that were deleted via the network.

[JP]

Thanks Squid.  I did check the system log and I'm not seeing anything that stands out for the specific app that I think could have been the culprit.  Out of curiosity, the Recycle Bin wouldn't help me recover those files now since it has already been deleted...correct?

[Squid]

Correct.

 

And, it only handles things over the network.  Any "local" deletions (ie: via a docker app) won't be covered either.

 

Another option is to also set the additional path mappings to the container to be read-only (where applicable of course)