Finding out why/how a folder is being created

There's a folder on my Linux desktop which shouldn't exist. The first time I saw it, I thought I'd accidentally copied it from somewhere else, so I deleted it. Now it's back again. So it must have been automatically created by some process, but what can I do to figure out which program is creating it? I think it's likely that if I delete the folder it'll eventually be created again, so I should be able to catch this program in the act if anyone can suggest a technique for doing so.

By the way, there are no files in this mystery folder, and its name is the same as another folder I created months ago to hold my personal documents, not something that a program would create to hold its own configuration files or the like.

EDIT: Since I asked this question the folder hasn't shown up again, so I guess I could consider the problem solved... but I'd still be interested to know if anyone has an idea of some tool I could use if this happens again.

EDIT 2: IT'S BAAAACK.... yes, the mysteriously reappearing folder has reappeared. The modification time is July 2, ~10:30 PM EDT, just over a week after I last edited this question, so I guess that's when it was recreated, but that doesn't tell me what might have put it there. So I am still interested in any other answers.

linux

David Z

Posted 2010-06-22T09:02:59.427

Reputation: 5 688

Where is this folder located? What's its name? Maybe it's the standard folder defined by some desktop environment for storing documents (eg. "Documents") and the desktop environment is recreating it when it's missing. – goedson – 2010-06-22T13:02:16.303

Who is the owner of the folder? Does that lead you to its creator? – JRobert – 2010-06-22T14:04:38.650

@goedson: The folder is named PHYS542. Like I said, I highly doubt that's any sort of standard folder. @JRobert: the folder is owned by me (it's a single-user system), so unfortunately that doesn't tell me anything useful. Well, I guess I know it's not being created by root but that doesn't narrow it down enough. – David Z – 2010-06-22T15:04:43.243

Have you tried greping for PHYS542 on your system? Maybe it could help you find which executable is creating this. – goedson – 2011-04-27T11:54:11.307

@goedson: good idea, although the problem hasn't reoccurred since last summer so I suspect I wouldn't find anything now. I'll try it anyway and see if anything pops up. – David Z – 2011-04-27T17:32:44.723

Answers

Mark the Desktop folder as not writeable. After 24 hours or so, grep your logs for the string "Desktop", because the process that fails to create the folder might log an error when it isn't able to.

CarlF

Posted 2010-06-22T09:02:59.427

Reputation: 8 576

I presume you meant the parent of the mysteriously appearing folder, rather than "Desktop"? (I used "desktop" in the question to refer to my computer, not to the Desktop folder) Anyway, the folder actually hasn't shown up in a while but if it does I'll definitely try this. Thanks! – David Z – 2010-10-21T06:18:03.240

I once played a prank on my dad by editing cron to re-create a file every 60 seconds so it would show up again even if it was deleted. Is there any chance someone might be pranking you?

In any case, run a crontab -l from your account to see if anything is scheduled to run automatically. There typically is nothing in cron unless you manually scheduled something to run on a regular bases.

James T

Posted 2010-06-22T09:02:59.427

Reputation: 8 515

Thanks for the answer, but it's not that; it's a single-user system and I'm the only one with physical access. (And AFAIK there's no way to gain remote access - it's behind a router and there's no incoming port forwarding configured.) Plus crontab -l was the first thing I checked ;-) there was nothing there. – David Z – 2010-06-22T15:07:58.757