Who did delete a file

but what we are going to do when a machine has unix operating system and ex3 file system?

It depends.

Has the specific "unix operating system" a "recycle bin" 😯 , or - more loosely - what happens on Windows if you delete a file without sending it to the Recycle Bin ?

http//spin.atomicobject.com/2012/06/29/restoring-deleted-files-from-the-ext3-journal/

jaclaz

but what we are going to do when a machine has unix operating system and ex3 file system?

There's a good write up in the SANS reading room concerning making use of the ext3 journal for forensics..

ext3 journal forensics

I would be looking for the delete time (dtime), then seeing who was logged on at that time, then grep through their shell history for "rm" etc..

If the file required elevated privilege to delete, you might also find reference in var/log/auth.log

–MG

thanks a lot