1

enter image description here

This is an NTFS partition and some program keeps rewriting these folders (except Muzik which is my own created folder, RECYCLER and $RECYCLE.BIN) even after I delete them. Do you know how to figure out the source which makes these folders? (I dual boot Debian Jessie with Windows 7 x64)

Each folder have a file like this in them:

enter image description here

An ls -ll returns this: http://paste.debian.net/82233/

2
  • 1
    Which operating system is creating the files Windows or Debian?
    – Ramhound
    Feb 15, 2014 at 18:16
  • @Ramhound Debian.
    – sterz
    Feb 15, 2014 at 18:43

2 Answers 2

1

Try file command, it will detect the content in that file. Should be able to give you a rough idea what those files are and who created them.

Or you can try auditd, and place an watcher on the directory where those files are created. Here's a post http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html that should help.

1
  • file command tells me that they are data files (not much help there). I will setup an auditd watcher.
    – sterz
    Feb 15, 2014 at 19:21
0

IF the unknown program is a linux program you could see some results with one of these programs:

lsof /mnt/depomnt 
fuser /mnt/depomnt

But why don't you know if Windows or Linux created the files? Just delete them and wait some time in one OS and if nothing happens, change to the other (and look at the creeation time of the files).

Did you look into these files? The index.dat and ??/*.file

[another test] The directory structure looks like some sort of cache (proxy server?). Does the following command show any files apart from the mount files (fstab,mtab)?

grep -F depomnt /etc/
1
  • I've deleted them and rebooted: it's Debian that creates them. Yes, I've looked into those files and their content is gibberish (i.imgur.com/n0NyMWA.png & i.imgur.com/FIqDDOD.png). Also both lsof and fuser return nothing.
    – sterz
    Feb 15, 2014 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .