[CLUE-Tech] Disappearing files

[Chris Schock]

You can start with going through whatever history files are out there for
the various users and their shells, for example .bash_history.

Tripwire may also be of help; I haven't used it but I know it looks for
file changes and it may also record who deleted a file.

> Since this has the
> potential to continue happening, are there any utilities out there which
> can monitor filesystem changes, by whom, and when?  I'm guessing this
> will have to be some sort of log that the kernel keeps.