Related

Block storage directory limitations Question Question
Block Storage Rollout ETA's Question Question

Question

Can I see how data got onto my block storage?

Posted July 14, 2020 359 views
Block Storage

We’ve got a block storage volume on one of our droplets (CentOS Linux) which contains 38Gb of data. Viewing random files and folders within this makes it look like a backup of everything on the droplet. This appears to have happened only once, on 3rd December 2019.

The thing is, I’ve got no idea how this backup was taken and mapped to the block storage.

Can anyone suggest any way I might be able to check this or search for how this backup was taken and stored on the block storage?

Thanks in advance.

Add a comment
zigojacko
By:
zigojacko
Add a comment

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
1 answer
bobbyiliev July 14, 2020

Hi there @zigojacko,

I could suggest a couple of things:

  • Check your shell history and look for commands that might have been used to copy your files to the specific block storage, you could run the history command to see all previous commands

  • Check where exactly is the block storage mounted on, you could do that with the following command:

df -h

Let me know how it goes!
Regards,
Bobby

Reply Report
  • zigojacko July 14, 2020

    Thanks for your reply Bobby.

    Is there a command to search in all the historic shell commands?

    Because there’s probably several thousands since December last year.

    The block storage is mounted in what I presume is the default location /mnt - I knew this already and have viewed random content contained within it.

    I recall exploring ways to take server backups and storing them within our block storage volumes but I never found a successful way of doing it with our set up - at least, I can’t remember ever coming up with a solution - yet there all this 38Gb of data is… :)

    Reply Report
    • bobbyiliev July 14, 2020

      Hi there @zigojacko,

      What you could do is combine the history command with grep. For example:

      • history | grep `cp`

      The above command will pipe the output of the history command and then grep for the cp keyword. The grep command is basically used to search for strings on a specific output or a file.

      You could try searching for commands like cp, rsync, scp, mv and etc. as those commands have the power of copying all of your files from one place to another.

      Hope that this helps!

      Regards,
      Bobby

      Reply Report
      • zigojacko July 14, 2020

        Great thanks for this.

        I’ve searched the entire historic commands for mnt as this path would have to have been entered for storing anything at this location and it found no results.

        SO, it doesn’t look like anything was performed over the command line for this (which is what I would have thought too).

        Thanks.

        Reply Report
        • bobbyiliev July 14, 2020

          Hi there @zigojacko,

          It is quite possible that the history commands have been rotated.

          Usually, the default history file size is 1000 entries only, after that the old entries are rotated.

          What other backup solutions have you tried? If you were using a script or another automated backup solution, then it might explain the situation as well.

          Regards,
          bobby

          Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help