Ownloud deleted file wihout my order

Expected behaviour

Actual behaviour

ownloud deleted file wihout my order

It looks like it deleted some older files in the directory structure

Can I check who initiated the action?
server or client?
or which of the clients?

Steps to reproduce

  1. single event

Server configuration

Operating system:
Linux jessie 3.16.0-5-amd64 #1 SMP Debian 3.16.51-3+deb8u1 (2018-01-08) x86_64 GNU/Linux
Web server:
apache2: : 2.4.10-10+deb8u13
Database: ‘dbtype’ => ‘mysql’,
‘version’ => ‘8.1.9.2’,

PHP version:
php5: 5.6.40+dfsg-0+deb8u1
ownCloud version:
owncloud-server 8.1.9-12.1

Storage backend (external storage):

Client configuration

Client version:
owncloud-client:
Zainstalowana: 2.5.4.11654+oc-515
Operating system:
Linux 3.16.0-4-amd64 #1 SMP Debian 3.16.51-3 (2017-12-13) x86_64 GNU/Linux

Qt version used by client package (Linux only, see also Settings dialog):

Client package (From ownCloud or distro) (Linux only):

Installation path of client:

Logs

Please use Gist (https://gist.github.com/) or a similar code paster for longer
logs.

Template for output < 10 lines

  1. Client logfile: Output of owncloud --logwindow or owncloud --logfile log.txt
    (On Windows using cmd.exe, you might need to first cd into the ownCloud directory)
    (See also http://doc.owncloud.org/desktop/2.2/troubleshooting.html#client-logfile )

  2. Web server error log:

  3. Server logfile: ownCloud log (data/owncloud.log):
    empty ??

Hi,

Without any server logs, it will be hard to figure anything out here.
Perhaps you have some logs in your backups?

Have a close look in your apache access logs.
A delete from the web interface should like this:

192.168.122.1 - - [17/Jun/2019:11:56:54 +0200] "DELETE /remote.php/dav/files/admin/ownCloud%20Manual.pdf HTTP/1.1" 204 - "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0"

If you delete a file in the sync client it should look something like this:

192.168.122.1 - admin [17/Jun/2019:12:08:48 +0200] "DELETE /remote.php/dav/files/admin/ownCloud%20Manual.pdf HTTP/1.1" 204 - "-" "Mozilla/5.0 (Linux) mirall/2.5.4 (build 515)"

As you can see, the username, date and time is shown. The client is distinguishable via the user agent string. The source IP is also shown, which should be correct as long as you don’t have a reverse proxy in front of your ownCloud instance and the logging isn’t set up correctly.

I would like to mention that your ownCloud server version is rather old, and I only had a recent version for copying these log lines available. I would hope that nothing much would have changed regarding this since though.

Hope that get’s you started, let me know should you have any further questions.
Cheers,
Erik

Thank you for the answer
I found these logs
All of the files was delete at the same time

the first :
10.55.200.200 - olaf [14/Jun/2019:16:00:40 +0200] “DELETE /owncloud/remote.php/webdav/2019/24/graph_gen.nb HTTP/1.1” 204 690 “-” “Mozilla/5.0 (Linux) mirall/2.4.3 (build 10035)”

the last :
10.55.200.200 - olaf [14/Jun/2019:16:09:33 +0200] “DELETE /owncloud/remote.php/webdav/polit.txt HTTP/1.1” 204 690 “-” “Mozilla/5.0 (Linux) mirall/2.4.3 (build 10035)”

gunzip -kc access.log.3.gz | grep DELETE | wc -l
3110 files deleted :frowning:

I have compared these entries with login entries from the browser:

“Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0”
or
“Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Safari/537.36”

it looks like other browsers??

I can not distinguish IP because connection to the server is via VPN. In the history of my browser there is a first connection at 16:16 - I tried to check what happened.

Tt’s unlikely it would be a hacking because algorithm of deleting is not trivial.
In a complicated directory structure, several of the oldest files have been deleted.

I cant see the rules - there was a different date in different directory (but always the oldest)

And question for the future:
Is there a way to automatically restore files by date or by logs?
It is not possible to manual restoring 3000 files :slight_smile:
I have a backup of course , and i have a laptop unconncted to server at this time so the files are save

with regards, Olaf

This would tell me that it was a sync client. So it only matters what stands behind the DELETE request as user agent string.

See above.
I would assume somebody with sync client access accidentally moved those files out of the synced ownCloud folder, without setting the specific selective sync settings first. Either just to another location on their local disk or into the trash bin because they ran out of disk space on their local machine.

I think the easiest way for you to restore the files would be to use that laptop.

  1. You make a copy of all the files on the laptop
  2. You connect the laptop back up with the ownCloud instance
  3. Wait for it to finish syncing
  4. You copy the files, that you backed up in step 1, into your synced ownCloud folder on the laptop.
  5. While copying it will ask you how you want to merge your folders, chose ‘Skip existing files’ (or whatever it is called on your OS/file browser)
  6. The sync client will upload all new files (the ones that were deleted)

Hope that makes sense.
Cheers,
Erik