Can I see how data got onto my block storage?

Question

We’ve got a block storage volume on one of our droplets (CentOS Linux) which contains 38Gb of data. Viewing random files and folders within this makes it look like a backup of everything on the droplet. This appears to have happened only once, on 3rd December 2019.

The thing is, I’ve got no idea how this backup was taken and mapped to the block storage.

Can anyone suggest any way I might be able to check this or search for how this backup was taken and stored on the block storage?

Thanks in advance.

Answer 1

bobbyiliev July 14, 2020

Hi there @zigojacko,

I could suggest a couple of things:

Check your shell history and look for commands that might have been used to copy your files to the specific block storage, you could run the history command to see all previous commands
Check where exactly is the block storage mounted on, you could do that with the following command:

df -h

Let me know how it goes!
Regards,
Bobby

Reply Report

zigojacko July 14, 2020

Thanks for your reply Bobby.

Is there a command to search in all the historic shell commands?

Because there’s probably several thousands since December last year.

The block storage is mounted in what I presume is the default location /mnt - I knew this already and have viewed random content contained within it.

I recall exploring ways to take server backups and storing them within our block storage volumes but I never found a successful way of doing it with our set up - at least, I can’t remember ever coming up with a solution - yet there all this 38Gb of data is… :)
Reply Report
- bobbyiliev July 14, 2020
  
  Hi there @zigojacko,
  
  What you could do is combine the history command with grep. For example:
  
  history | grep `cp`
  
  The above command will pipe the output of the history command and then grep for the cp keyword. The grep command is basically used to search for strings on a specific output or a file.
  
  You could try searching for commands like cp, rsync, scp, mv and etc. as those commands have the power of copying all of your files from one place to another.
  
  Hope that this helps!
  
  Regards,
  Bobby
  
  Reply Report
  
  zigojacko July 14, 2020
  
  Great thanks for this.
  
  I’ve searched the entire historic commands for mnt as this path would have to have been entered for storing anything at this location and it found no results.
  
  SO, it doesn’t look like anything was performed over the command line for this (which is what I would have thought too).
  
  Thanks.
  
  Reply Report
  
  bobbyiliev July 14, 2020
  
  Hi there @zigojacko,
  
  It is quite possible that the history commands have been rotated.
  
  Usually, the default history file size is 1000 entries only, after that the old entries are rotated.
  
  What other backup solutions have you tried? If you were using a script or another automated backup solution, then it might explain the situation as well.
  
  Regards,
  bobby
  
  Reply Report

Answer 2

zigojacko July 14, 2020

Thanks for your reply Bobby.

Is there a command to search in all the historic shell commands?

Because there’s probably several thousands since December last year.

The block storage is mounted in what I presume is the default location /mnt - I knew this already and have viewed random content contained within it.

I recall exploring ways to take server backups and storing them within our block storage volumes but I never found a successful way of doing it with our set up - at least, I can’t remember ever coming up with a solution - yet there all this 38Gb of data is… :)
Reply Report
- bobbyiliev July 14, 2020
  
  Hi there @zigojacko,
  
  What you could do is combine the history command with grep. For example:
  
  history | grep `cp`
  
  The above command will pipe the output of the history command and then grep for the cp keyword. The grep command is basically used to search for strings on a specific output or a file.
  
  You could try searching for commands like cp, rsync, scp, mv and etc. as those commands have the power of copying all of your files from one place to another.
  
  Hope that this helps!
  
  Regards,
  Bobby
  
  Reply Report
  
  zigojacko July 14, 2020
  
  Great thanks for this.
  
  I’ve searched the entire historic commands for mnt as this path would have to have been entered for storing anything at this location and it found no results.
  
  SO, it doesn’t look like anything was performed over the command line for this (which is what I would have thought too).
  
  Thanks.
  
  Reply Report
  
  bobbyiliev July 14, 2020
  
  Hi there @zigojacko,
  
  It is quite possible that the history commands have been rotated.
  
  Usually, the default history file size is 1000 entries only, after that the old entries are rotated.
  
  What other backup solutions have you tried? If you were using a script or another automated backup solution, then it might explain the situation as well.
  
  Regards,
  bobby
  
  Reply Report

Related

Question

Can I see how data got onto my block storage?

Related

Leave a comment

Looking for something else?

Sign up for our newsletter

Related

Question

Can I see how data got onto my block storage?

Related

Leave a comment

Related

question

Block storage directory limitations

question

Block Storage Rollout ETA's

question

Can a block storage mount point be accessed in multiple droplets?

question

Can I rename a storage volume?

Looking for something else?