Cryptic unkown file?

[SF6]

Hi,

for some reason a file has appeared in my /home directory:
?Ŷ?Ƶ????

david@PC:~> ls
bin  Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos  ?Ŷ?Ƶ????

Supposedly it's 30kB but it cannot be deleted as it shows the file to be "non-existant":
Where does it come from? What's doing there and how can I get rid of it?

Thanks

[xorbe]

I have experience with this recently on a RedHat server. You can do something like:

md tmp
mv * tmp
cd tmp
mv [a-zA-Z0-9_]* ..

Then examine that the only thing left is the offending file, else move any remaining files/folders back. Once the offending filename is isolated, you can either delete ~/tmp, or give it a sane name by doing "mv * filename" if you want to further examine the file.

[eng-int]

for some reason a file has appeared in my /home directory:
?Ŷ?Ƶ????
...
cannot be deleted as it shows the file to be "non-existant":
Where does it come from? What's doing there and how can I get rid of it?

What is it ?
You do not say who owns this file, when it was created/modified or what it contains.
As this appears to be a “desktop session” machine, the simplest thing to do is to use a graphical file manager to find the file properties and delete it via the right-click menu -- hold the shift-key down to convert “Move to Wastebin” to “Delete”.

One of your problems could be that it is possible to create a filename that starts and/or ends in a non-printing character or space. Otherwise you can often manipulate the file(name) by enclosing it in (single) quotes.

[hcvv]

Hi,

for some reason a file has appeared in my /home directory:
?Ŷ?Ƶ????

david@PC:~> ls
bin  Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos  ?Ŷ?Ƶ????

Supposedly it's 30kB but it cannot be deleted as it shows the file to be "non-existant":
Where does it come from? What's doing there and how can I get rid of it?

Thanks

Why do you not at least give an

ls -l

so we (and you) have a little bit of information about that file.

Also

file *

And saying "it shows ..." is no information. Who is "it"?

[hcvv]

I have experience with this recently on a RedHat server. You can do something like:

md tmp
mv * tmp
cd tmp
mv [a-zA-Z0-9_]* ..

Then examine that the only thing left is the offending file, else move any remaining files/folders back. Once the offending filename is isolated, you can either delete ~/tmp, or give it a sane name by doing "mv * filename" if you want to further examine the file.

I think one should be careful with this. I do not know where you did this and doing it in some directory with data might be harmless, but doing it in one's own home directory while being logged in might be a bad idea.

[SF6]

True that is, here is the information:

ls -l:

-rw-r--r--   1 david users 31170 Jul  9 12:21 ?Ŷ?Ƶ????

file * gives:

�Ŷ�Ƶ���: data

[hcvv]

Thanks a lot.

True that is, here is the information:

ls -l:

-rw-r--r--   1 david users 31170 Jul  9 12:21 ?Ŷ?Ƶ????

Which shows that it david is the owner and that it has "normal" permissions. In fact it tells us not much more then that it was a process used by david that created it. But negative info is also info.

file * gives:

�Ŷ�Ƶ���: data

Which looks as being a bit useless because everything is data of course. But as file is pretty good at detecting all sorts of file formats, we may conclude that it is not just one of the more common ones with a strange name. It is has also an unknown contents (e.g. file would detect plain ASCII text if it was something like that).

Now there are two ways to go. One is to simply remove the file, which will never tell us why and what. The other is to try to find out first if we can get more information out of that file.

It is of course up to you to decide. It isn't really in the way I presume, thus we can spend some time on investigating. But when you just want to remove it and carry on, that is fine, but you never know if it will happen again tomorrow.

First thing would be to see if we can find a regexp that gives you the file name. Try

ls *Ŷ*

When that gives you the file, the try to find what the bytes in the name are:

ls *Ŷ* | od -x

Oh and btw, when posting commands and their output, best is to post complete: the prompt, the command, the output and the next command. Like you did in the first post here. Then we can be sure we see all there is to see.

[xorbe]

Yes, my suggested idea of using regex to get at the filename is the key for a command line solution. That's also a good application of the idea.

[hcvv]

Yes, my suggested idea of using regex to get at the filename is the key for a command line solution. That's also a good application of the idea.

Well, the problem here is IMHO not so much to use some expression. That you do normally when there are some characters "that are special to the shell" in the name. But in this case there are apparently some bytes there that do not fit into the used character encoding (most probably UTF-8). Thus, what we see is just a sort of fall back interpretation of the software component that tries to create the characters. And that "emergency action" might result in different solutions for different software (see the ? in one listing and the � in another).

I do not think that removing it will be a big problem. But the real solution (root cause) is of course: which program created it and why did it use such a strange encoding (if it is an encoding and not some random bytes).

[d3vnull]

To see hidden characters in the file name you should be able to use: ls -b

To see the content of the file as an octal dump of characters, because of where you show it is located you can try:

find . -maxdepth 1 -type f ! -name '.*' -exec od -c {} \;

You can probably also use the same find command to remove the file.