Is there a UNIX command to list all recently removed files from a system

*nix systems typically have a locate utility installed. It has a database, usually updated nightly, that has the names of (almost) all files on your system. Just run:

locate /path/to/dir/of/interest

and you should see a list of files that were in that directory as of the last database update. You can diff this against the current list.

Because it will be overwritten automatically with a new version, you might make a back-up copy of that database now. On debian-influenced systems, it is stored in /var/lib/mlocate/mlocate.db.

How to show missing files

1. Make a backup of the old database:

   cp /var/lib/mlocate/mlocate.db ~/old.db
   

2. Update the database. The command to do this may vary. On a debian-like system, try:

   sudo /etc/cron.daily/mlocate
   

3. Get the new and old file lists for your directory:

   locate -d ~/old.db /your/dir | sort >~/old.list
   locate /your/dir | sort >~/new.list
   

4. Get a list of all new and missing files:

   diff ~/old.list ~/new.list
   

Additional notes

• Not all files are listed in locate's database. A configuration file, typically /etc/updatedb.conf, determines which files and directories are excluded.

• In the past I have used some version of locate that, by default, would only list files that still exist. If that is the case for your locate, you will want to turn that feature off.