HI,

I am using a multiuser solaris 5.9 machine. An entire directory is missing ! I conclude dat someone has deleted / done rm -rf *. The username is common to 3 ppl. There is also a root user. Is it possible to find out who and when this delete action was done?

Kindly help me. One month's work is lost

I'm going with sun on this.

"Be careful when you use the rm command, and be particularly careful when you use rm with the wildcard character (*). You cannot recover files that you have removed with rm. "

The data in fact could be there is you can access the slice raw and view it that way.

Hard to tell, there is a security issue that could be an issue. Might have caused this too.

See user logs if they exist. Not sure if you can put a file level log on sun.

I read it wrong and answer it wrong too. So get off my case you peanut.