Is it possible to find out which files and directories have recently been deleted by rm in OS X? Or failing that, is it possible to find which parent directories have had files or directories within it deleted?

The OS version is Snow Leopard.

Background: Last night, rvm (ruby version manager) did rm -rf of the ~/ruby directory from the home directory. (This bug has since been fixed)

Ideally, I'd like to know what files within the ~/ruby directory were deleted, but failing that, I'd like to know if rvm deleted anything outside of ~/ruby .

In case anyone's wondering about backups...: Just about everything within ~/ruby is a git project that has a remote repo, and I have a fairly recent Time Machine backup (only 20 days old).

  • Are you looking specifically for this case or is this something you would generally like to know? In this case, you should be able to get your information by comparing with your git repo or your backup, right? Having said that, I doubt you can get any information about rm history. – fideli Dec 31 '10 at 2:52

I ended up using unix find to look for directories that had a recent modification date. It indicated that the only folders that had a recent modification date (apart from some boring cached data directories) was ~/ruby and a subfolder that contained undeleteable files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.