Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any tool or logs which could give information about it? Also, if there is no way to find out the above then... can I do something which informs me when someone or some service tried to delete the folder.

share|improve this question
up vote 0 down vote accepted

This small Dtrace script will easily log every file deletion in the system:

dtrace -qn 'syscall::unlink*:entry { printf("%d, %s, %s\n", uid, execname, copyinstr(arg0));}
syscall::fsat:entry  /arg0 == 5 / { printf("%d, %s, %s\n", uid, execname, copyinstr(arg2));}'
share|improve this answer

AFAIK there is no "out the box" solution but you could use an event driven file watcher for file system events (on the directory its in) - then look up the offending program(s) that match the handle.

If you need such an application then it may be worth asking on StackOverflow as you cannot be the only with such a need.

share|improve this answer
StackOverflow is only appropriate if you intend to write such an application yourself – Nifle Jul 17 '10 at 14:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.