We are running a small local server for our office. We have LAMP configured, and there are 20 people using locally deployed php application. Few of the users use FTP to access the designated folders to upload files directly to the server.

Yesterday, the system suddenly stopped, and the application page was not accessible at the clients computers, instead, the application directory was listed on the brower when someone tried to access the application.

When I check through FTP client, I found that almost all files from the www/application folder were deleted (code + images/audio/video files). There were also some other foldres in www, which were also deleted. We had backup to restore the lost files, so that's done, but I really wanted to know what happend?

We checked all the logs, FTP, Apache, System etc, but did not find any deletion log. There were normal deletion log enteries in the FTP log for time before this big deletion has happend. So appearently, the FTP logs does log the deletion activity, but this particular (almost 4,000+ files) deletion is not logged anywhere.

We have firewall, and all security in place.

Plz help us how to trace what has happend. We are using Ubuntu server 2.6.38.