21 November 2008 @ 22:20Preventing important files from being deleted

I must give you some background before proceeding, because otherwise, the task being performed might seem utterly useless, or just plain strange.

Captured Video folder I am one of a few network administrators that has access to an entire network of computers. These computers include some Macs that capture surveillance video using SecuritySpy. A problem occurs when archived video “mysteriously” disappears in what seems to be another administrator trying to hide illicit behavior.

Since I cannot change the password to the machine without drawing unnecessary attention to myself, I wanted to find a more discreet answer to the problem of the deleted files. The first solution that crossed my mind was some sort of backup plan. Unfortunately, most backup solutions operate on a repeating schedule, so video that is captured between the backup intervals could still be deleted. Another issue with backing up or copying video files is that the files can be quite large and the backup process can get rather lengthy. I needed something quick and silent.

So, I came up with a Folder Action that is attached to the ~/.Trash folder. The action will move any files that are added to the Trash and place them in a hidden folder where they can later be retrieved.

First, the following code must be pasted into a blank Script Editor document and saved as trash_mover.scpt in /Library/Scripts/Folder Action Scripts/

(*
This script is a Folder Action that is intended to be
attached to the ~/.Trash folder.
It will backup(or rather, move) the contents of Trash to a new, hidden location
so that the files can be retrieved at a later time.
This code is provided "AS IS" and the
responsibility for its operation is solely yours.
*)

on adding folder items to this_folder after receiving added_items
try
set the folder_name to the POSIX path of this_folder

do shell script "mkdir ~/.TrashBackup/back$(date \"+20%y-%m-%d-%H%M\")/; mv " & folder_name & "* ~/.TrashBackup/back$(date \"+20%y-%m-%d-%H%M\")/"

end try
end adding folder items to

Second, navigate to the ~/.Trash folder by going to the Home folder and pressing command+shift+G, then typing .Trash
Go to .Trash

Third, right-click on the .Trash folder and click More –> Configure Folder Actions…
Configure Folder Actions...

Fourth, check the box marked “Enable Folder Actions”. Click the plus sign under the left half of the window, then drag the .Trash folder’s icon into the selection window and click “Open”. Next, click the plus sign under the right half of the window to assign an action to that folder. Select “trash_mover.scpt”. You can then close that window.
Folder Actions Setup

That’s it. Now any file or folder that gets put in the Trash will get moved to ~/.TrashBackup/ and put in a timestamped folder. You can get to these folders in either the Terminal by typing cd ~/.TrashBackup/ , or in the Finder by using the command+shift+G shortcut.

I should note that this is kind of a hack solution. The Trash is now useless for deleting stuff unless the Folder Action is disabled. Files can instead be deleted from the Terminal using the rm command. This solution is not extremely practical, but it does do what I set out to do, and that is to try to rescue files from being deleted by users who you cannot or should not lock out of the system. It also gives you an opportunity to audit the files put in the trash before deleting them permanently.

The best solution to protecting your files is to have a password-protected user account with auto-login disabled, and only one person knowing your password — you. Also make regular backups of all your important data on an external hard drive.

Be Sociable, Share!