21 November 2008 @ 22:20Preventing important files from being deleted
I must give you some background before proceeding, because otherwise, the task being performed might seem utterly useless, or just plain strange.
I am one of a few network administrators that has access to an entire network of computers. These computers include some Macs that capture surveillance video using SecuritySpy. A problem occurs when archived video “mysteriously” disappears in what seems to be another administrator trying to hide illicit behavior.
Since I cannot change the password to the machine without drawing unnecessary attention to myself, I wanted to find a more discreet answer to the problem of the deleted files. The first solution that crossed my mind was some sort of backup plan. Unfortunately, most backup solutions operate on a repeating schedule, so video that is captured between the backup intervals could still be deleted. Another issue with backing up or copying video files is that the files can be quite large and the backup process can get rather lengthy. I needed something quick and silent.
So, I came up with a Folder Action that is attached to the ~/.Trash folder. The action will move any files that are added to the Trash and place them in a hidden folder where they can later be retrieved.
First, the following code must be pasted into a blank Script Editor document and saved as
trash_mover.scpt in /Library/Scripts/Folder Action Scripts/
Second, navigate to the ~/.Trash folder by going to the Home folder and pressing command+shift+G, then typing
Third, right-click on the .Trash folder and click More –> Configure Folder Actions…
Fourth, check the box marked “Enable Folder Actions”. Click the plus sign under the left half of the window, then drag the .Trash folder’s icon into the selection window and click “Open”. Next, click the plus sign under the right half of the window to assign an action to that folder. Select “trash_mover.scpt”. You can then close that window.
That’s it. Now any file or folder that gets put in the Trash will get moved to ~/.TrashBackup/ and put in a timestamped folder. You can get to these folders in either the Terminal by typing
cd ~/.TrashBackup/ , or in the Finder by using the command+shift+G shortcut.
I should note that this is kind of a hack solution. The Trash is now useless for deleting stuff unless the Folder Action is disabled. Files can instead be deleted from the Terminal using the
rm command. This solution is not extremely practical, but it does do what I set out to do, and that is to try to rescue files from being deleted by users who you cannot or should not lock out of the system. It also gives you an opportunity to audit the files put in the trash before deleting them permanently.
The best solution to protecting your files is to have a password-protected user account with auto-login disabled, and only one person knowing your password — you. Also make regular backups of all your important data on an external hard drive.