Finding where/why mysterious fedora-extra-bk came from

hello, i recently noticed on one of my mountpoints that i have a dir called “fedora-extra-bk” - doing some searching here and online doesn’t seem to yield any similar info, and I’m wondering where it came from/why it is there (as opposed to any other mount point, etc):
indoorjetpacks@skywalker:.../large_data$ pwd
/mnt/large_data
indoorjetpacks@skywalker:.../large_data$ ls -la
total 25876
drwxr-xr-x 28 indoorjetpacks indoorjetpacks 4096 Dec 29 10:45 .
drwxr-xr-x. 11 root root 4096 Dec 30 10:00 ..
drwxrwx---. 3 indoorjetpacks indoorjetpacks 4096 Dec 30 2024 ApartmentModel
drwxr-xr-x. 16 indoorjetpacks indoorjetpacks 4096 Aug 7 17:25 ardour_sessions
drwxr-xr-x. 3 indoorjetpacks indoorjetpacks 4096 Jun 23 2025 DeskSetup
drwxr-xr-x. 3 indoorjetpacks indoorjetpacks 4096 Dec 29 10:47 Documents_Linux
drwxr-xr-x. 47 indoorjetpacks indoorjetpacks 4096 May 18 2025 Documents_Windows
drwxr-xr-x. 4 indoorjetpacks indoorjetpacks 4096 Dec 22 22:46 fedora-extra-bk

it appears to be, as stated, a backup of /etc and /var - I’m trying to figure out where it may have come from, and why it’s there. I know there’s the mtime listed, but how would I go about finding what may have created it, via some log files or something that I could look at, filtered for about that date? How/where would I go about finding those?

I did recently-ish (not that date) update from Fedora 41 → Fedora 42, so I am guessing it may have come from that, but I’d like to get more information about it, and why it got put on that mountpoint (if it’s just, the Nth thing in /etc/fstab possibly? Curiously, that mount point is the first one in my fstab that is formatted with quotations as UUID=”xxxxx-xxxxx-xxxxx” whereas all the others are UUID=xxxxx-xxxxxx-xxxxxx - not the actual UUIDs but just something that stands out to me)

inxi info:

```indoorjetpacks@skywalker:.../fedora-extra-bk$ inxi -DPSz
System:
Kernel:6.17.13-200.fc42.x86_64arch:x86_64bits:64
Desktop:KDE Plasmav:6.5.4Distro:Fedora Linux 42 (KDE Plasma Desktop
Edition)
Drives:
Local Storage: total:11.83 TiBused:7.28 TiB (61.5%)
ID-1:/dev/nvme0n1vendor:Western Digitalmodel:WD Blue SN570 500GB
size:465.76 GiB
ID-2:/dev/sdavendor:Samsungmodel:SSD 840 Seriessize:232.89 GiB
ID-3:/dev/sdbvendor:Samsungmodel:SSD 870 EVO 250GBsize:232.89 GiB
ID-4:/dev/sdcvendor:Western Digitalmodel:WD6003FZBX-00K5WB0
size:5.46 TiB
ID-5:/dev/sddvendor:Toshibamodel:HDWD120size:1.82 TiB
ID-6:/dev/sdevendor:Samsungmodel:SSD 870 EVO 4TBsize:3.64 TiB
Partition:
ID-1:/size:93.24 GiBused:41.52 GiB (44.5%)fs:ext4dev:/dev/sdb2
ID-2:/boot/efisize:511 MiBused:19.3 MiB (3.8%)fs:vfat
dev:/dev/sdb1
ID-3:/homesize:457.38 GiBused:303.57 GiB (66.4%)fs:ext4
dev:/dev/nvme0n1p1
ID-4:/optsize:294.23 GiBused:42.57 GiB (14.5%)fs:ext4
dev:/dev/sde1
ID-5:swap-2size:15.62 GiBused:0 KiB (0.0%)fs:swapdev: /dev/sdb4
```

As a quick and dirty start, I’d try journalctl -g "fedora-extra-bk" to see if whatever created it made a log in the journal (and stated the directory name in that log entry).

That command also accepts --since and --until options if you want to further narrow down the time range.

2 Likes

Since the folder is owned by the user any log may be in the user journal.
I would also have a look at any files in folder for clues to the software that is using that folder.

1 Like