While cleaning up a portable HD I came across a directory that I cannot delete with the error that it is not empty, and that despite trying to delete it with the
-rf flags (I am running linux).
I went in the directory and found 3 hidden files titled:
.fuse_hidden00000e6f0000002f .fuse_hidden00000e8500000030 .fuse_hidden00000eb200000031
And upon deleting them they were instantly recreated, exactly the same by their checksums only with slightly different names (the last 2 characters advanced by 1 in hex).
Opening them with a hex editor I found mostly gibberish and some readable strings of files that might have been in the same directory before.
I tried to put a watch on that directory with
auditctl but in the logs I only see my command for deleting them, but not the one recreating the new ones.
Any ideas on how to continue from here? Mainly on how to find which process is recreating them?