3

I need to know which files have been copied to or removed from a directory or folder such /dev or /mnt or any other directory.

How can I do that?

Zanna
  • 72,312
hupaa
  • 33

1 Answers1

2

You could use inotifywait to monitor directories for files that have been accessed, deleted or moved.

Install inotify-tools 

sudo apt-get update  
sudo apt-get install inotify-tools

Then run: 

inotifywait -m -r /mnt

The "-m" option monitors the directory and "-r" is recursive. Unless otherwise specified by "-e" option, all events will be displayed as defined in the inotifywait manpage. The events can be sent to a log file by using the "-o" option: 

inotifywait -m -r -o /directory/logfile.txt /mnt
stumblebee
  • 4,379