Tutorial

Secure sensitive data across your Roundfleet devices using advanced file encryption and decryption techniques. This tutorial covers OpenSSL encryption methods, enterprise key management, security policies, and compliance monitoring for comprehensive data protection.

Understanding File Encryption on macOS

File encryption protects sensitive data by converting it into an unreadable format that can only be accessed with the correct decryption key. While macOS offers FileVault for full-disk encryption, selective file encryption provides granular control over specific documents and data files.

Key Encryption Methods

• DES (Data Encryption Standard) - Legacy encryption for basic protection
• AES-256-CBC - Advanced Encryption Standard with 256-bit keys
• AES-256-GCM - AES with Galois/Counter Mode for authenticated encryption
• ChaCha20-Poly1305 - Modern stream cipher with authentication
• RSA - Public-key encryption for key exchange and digital signatures

Basic File Encryption

Simple File Encryption

#!/bin/bash

# Basic file encryption using OpenSSL
INPUT_FILE="/path/to/original.txt"
OUTPUT_FILE="/path/to/encrypted.txt"
PASSWORD="your_secure_password"

openssl des -in "$INPUT_FILE" -out "$OUTPUT_FILE" -k "$PASSWORD"

echo "File encrypted successfully: $OUTPUT_FILE"

Enhanced File Encryption

#!/bin/bash

# Enhanced file encryption with validation
encrypt_file() {
    local input_file="$1"
    local output_file="$2"
    local password="$3"
    local algorithm="${4:-aes-256-cbc}"
    
    # Validate input parameters
    if [[ -z "$input_file" ]] || [[ -z "$output_file" ]] || [[ -z "$password" ]]; then
        echo "❌ Error: Missing required parameters"
        echo "Usage: encrypt_file <input_file> <output_file> <password> [algorithm]"
        return 1
    fi
    
    # Check if input file exists
    if [[ ! -f "$input_file" ]]; then
        echo "❌ Error: Input file does not exist: $input_file"
        return 1
    fi
    
    # Create output directory if it doesn't exist
    local output_dir
    output_dir=$(dirname "$output_file")
    mkdir -p "$output_dir"
    
    echo "🔒 Encrypting file with $algorithm..."
    echo "  Input: $input_file"
    echo "  Output: $output_file"
    
    # Perform encryption
    if openssl "$algorithm" -in "$input_file" -out "$output_file" -k "$password" 2>/dev/null; then
        echo "✅ File encrypted successfully"
        
        # Verify encrypted file was created
        if [[ -f "$output_file" ]]; then
            local file_size
            file_size=$(stat -f%z "$output_file" 2>/dev/null || echo "0")
            echo "  Encrypted file size: ${file_size} bytes"
        fi
        
        return 0
    else
        echo "❌ Encryption failed"
        return 1
    fi
}

# Usage examples
encrypt_file "/Users/john/Documents/sensitive.txt" "/Users/john/Encrypted/sensitive.enc" "mypassword123" "aes-256-cbc"

AES-256 Strong Encryption

#!/bin/bash

# Advanced AES-256-CBC encryption with salt
encrypt_file_aes256() {
    local input_file="$1"
    local output_file="$2"
    local password="$3"
    
    echo "🔐 Performing AES-256-CBC encryption..."
    
    # Use AES-256-CBC with salt for enhanced security
    if openssl aes-256-cbc -salt -in "$input_file" -out "$output_file" -k "$password"; then
        echo "✅ AES-256 encryption completed"
        
        # Generate file hash for integrity verification
        local hash
        hash=$(shasum -a 256 "$output_file" | cut -d' ' -f1)
        echo "  File hash (SHA-256): $hash"
        
        # Save hash for verification
        echo "$hash" > "${output_file}.sha256"
        echo "  Hash saved to: ${output_file}.sha256"
        
        return 0
    else
        echo "❌ AES-256 encryption failed"
        return 1
    fi
}

# Example usage
encrypt_file_aes256 "/path/to/document.pdf" "/path/to/document.pdf.enc" "strong_password_123!"

File Decryption

Basic File Decryption

#!/bin/bash

# Basic file decryption using OpenSSL
INPUT_FILE="/path/to/encrypted.txt"
OUTPUT_FILE="/path/to/decrypted.txt"
PASSWORD="your_secure_password"

openssl des -d -in "$INPUT_FILE" -out "$OUTPUT_FILE" -k "$PASSWORD"

echo "File decrypted successfully: $OUTPUT_FILE"

Advanced File Decryption

#!/bin/bash

# Advanced file decryption with verification
decrypt_file() {
    local input_file="$1"
    local output_file="$2"
    local password="$3"
    local algorithm="${4:-aes-256-cbc}"
    
    # Validate parameters
    if [[ -z "$input_file" ]] || [[ -z "$output_file" ]] || [[ -z "$password" ]]; then
        echo "❌ Error: Missing required parameters"
        echo "Usage: decrypt_file <input_file> <output_file> <password> [algorithm]"
        return 1
    fi
    
    # Check if encrypted file exists
    if [[ ! -f "$input_file" ]]; then
        echo "❌ Error: Encrypted file does not exist: $input_file"
        return 1
    fi
    
    echo "🔓 Decrypting file with $algorithm..."
    echo "  Input: $input_file"
    echo "  Output: $output_file"
    
    # Create output directory
    local output_dir
    output_dir=$(dirname "$output_file")
    mkdir -p "$output_dir"
    
    # Perform decryption
    if openssl "$algorithm" -d -in "$input_file" -out "$output_file" -k "$password" 2>/dev/null; then
        echo "✅ File decrypted successfully"
        
        # Verify hash if available
        verify_file_integrity "$input_file" "$output_file"
        
        return 0
    else
        echo "❌ Decryption failed - incorrect password or corrupted file"
        return 1
    fi
}

# Verify file integrity
verify_file_integrity() {
    local encrypted_file="$1"
    local decrypted_file="$2"
    local hash_file="${encrypted_file}.sha256"
    
    if [[ -f "$hash_file" ]]; then
        echo "🔍 Verifying file integrity..."
        local stored_hash expected_hash
        stored_hash=$(cat "$hash_file")
        
        # For verification, we need the original file hash (this is a simplified example)
        if [[ -f "$decrypted_file" ]]; then
            echo "  File integrity check completed"
        fi
    fi
}

# Usage example
decrypt_file "/path/to/document.pdf.enc" "/path/to/document_recovered.pdf" "strong_password_123!" "aes-256-cbc"

Batch File Operations

Encrypt Multiple Files

#!/bin/bash

# Batch encrypt multiple files
batch_encrypt() {
    local source_dir="$1"
    local encrypted_dir="$2"
    local password="$3"
    local file_pattern="${4:-*}"
    
    echo "📁 Batch encryption starting..."
    echo "  Source: $source_dir"
    echo "  Target: $encrypted_dir"
    echo "  Pattern: $file_pattern"
    
    # Create encrypted directory
    mkdir -p "$encrypted_dir"
    
    local count=0
    local success=0
    
    # Process files matching pattern
    while IFS= read -r -d '' file; do
        if [[ -f "$file" ]]; then
            local relative_path
            relative_path=$(realpath --relative-to="$source_dir" "$file")
            local encrypted_file="$encrypted_dir/${relative_path}.enc"
            
            # Create subdirectories if needed
            mkdir -p "$(dirname "$encrypted_file")"
            
            echo "  Processing: $relative_path"
            
            if openssl aes-256-cbc -salt -in "$file" -out "$encrypted_file" -k "$password" 2>/dev/null; then
                ((success++))
                echo "    ✅ Encrypted"
            else
                echo "    ❌ Failed"
            fi
            
            ((count++))
        fi
    done < <(find "$source_dir" -name "$file_pattern" -type f -print0)
    
    echo "🎉 Batch encryption completed: $success/$count files encrypted"
}

# Usage example
batch_encrypt "/Users/john/Documents" "/Users/john/Encrypted" "batch_password123" "*.txt"

Decrypt Multiple Files

#!/bin/bash

# Batch decrypt multiple files
batch_decrypt() {
    local encrypted_dir="$1"
    local output_dir="$2"
    local password="$3"
    
    echo "📂 Batch decryption starting..."
    echo "  Source: $encrypted_dir"
    echo "  Target: $output_dir"
    
    # Create output directory
    mkdir -p "$output_dir"
    
    local count=0
    local success=0
    
    # Process .enc files
    while IFS= read -r -d '' file; do
        if [[ -f "$file" && "$file" == *.enc ]]; then
            local relative_path
            relative_path=$(realpath --relative-to="$encrypted_dir" "$file")
            # Remove .enc extension
            local decrypted_file="$output_dir/${relative_path%.enc}"
            
            # Create subdirectories if needed
            mkdir -p "$(dirname "$decrypted_file")"
            
            echo "  Processing: $relative_path"
            
            if openssl aes-256-cbc -d -in "$file" -out "$decrypted_file" -k "$password" 2>/dev/null; then
                ((success++))
                echo "    ✅ Decrypted"
            else
                echo "    ❌ Failed"
            fi
            
            ((count++))
        fi
    done < <(find "$encrypted_dir" -name "*.enc" -type f -print0)
    
    echo "🎉 Batch decryption completed: $success/$count files decrypted"
}

# Usage example
batch_decrypt "/Users/john/Encrypted" "/Users/john/Decrypted" "batch_password123"

Enterprise Encryption Management Script

#!/bin/bash

# Roundfleet File Encryption Management System
# Comprehensive encryption/decryption management for enterprise environments

# Configuration
LOG_FILE="/var/log/roundfleet_encryption.log"
CONFIG_FILE="/etc/roundfleet/encryption_policy.conf"
KEY_STORE="/var/lib/roundfleet/keys"
AUDIT_LOG="/var/log/roundfleet_encryption_audit.log"

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Audit logging
audit_log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$AUDIT_LOG"
}

# Setup environment
setup_environment() {
    sudo mkdir -p "$(dirname "$LOG_FILE")" 2>/dev/null
    sudo mkdir -p "$(dirname "$CONFIG_FILE")" 2>/dev/null
    sudo mkdir -p "$KEY_STORE" 2>/dev/null
    sudo chmod 700 "$KEY_STORE" 2>/dev/null
}

# Load configuration
load_config() {
    if [[ -f "$CONFIG_FILE" ]]; then
        source "$CONFIG_FILE"
        log_action "Configuration loaded from $CONFIG_FILE"
    else
        # Default configuration
        DEFAULT_ALGORITHM="aes-256-cbc"
        REQUIRE_STRONG_PASSWORDS=true
        MIN_PASSWORD_LENGTH=12
        ENCRYPTION_ENABLED=true
        AUTO_BACKUP_KEYS=true
        COMPLIANCE_MODE="HIPAA"  # HIPAA, PCI-DSS, GDPR
        
        log_action "Using default encryption configuration"
    fi
}

# Validate password strength
validate_password() {
    local password="$1"
    
    if [[ "$REQUIRE_STRONG_PASSWORDS" != "true" ]]; then
        return 0
    fi
    
    # Check minimum length
    if [[ ${#password} -lt $MIN_PASSWORD_LENGTH ]]; then
        echo "❌ Password too short (minimum $MIN_PASSWORD_LENGTH characters)"
        return 1
    fi
    
    # Check complexity
    local has_upper has_lower has_digit has_special
    has_upper=$(echo "$password" | grep -c '[A-Z]')
    has_lower=$(echo "$password" | grep -c '[a-z]')
    has_digit=$(echo "$password" | grep -c '[0-9]')
    has_special=$(echo "$password" | grep -c '[^A-Za-z0-9]')
    
    if [[ $has_upper -eq 0 ]] || [[ $has_lower -eq 0 ]] || [[ $has_digit -eq 0 ]] || [[ $has_special -eq 0 ]]; then
        echo "❌ Password must contain uppercase, lowercase, digit, and special character"
        return 1
    fi
    
    return 0
}

# Generate secure key
generate_secure_key() {
    local key_name="$1"
    local key_file="$KEY_STORE/${key_name}.key"
    
    # Generate random 256-bit key
    openssl rand -base64 32 > "$key_file"
    chmod 600 "$key_file"
    
    log_action "Generated secure key: $key_name"
    audit_log "KEY_GENERATED: $key_name by $(whoami)"
    
    echo "$key_file"
}

# Encrypt file with enterprise features
enterprise_encrypt() {
    local input_file="$1"
    local output_file="$2"
    local key_name="$3"
    local algorithm="${4:-$DEFAULT_ALGORITHM}"
    
    if [[ "$ENCRYPTION_ENABLED" != "true" ]]; then
        echo "❌ Encryption is disabled by policy"
        return 1
    fi
    
    # Validate input file
    if [[ ! -f "$input_file" ]]; then
        echo "❌ Input file not found: $input_file"
        return 1
    fi
    
    # Get or generate key
    local key_file="$KEY_STORE/${key_name}.key"
    if [[ ! -f "$key_file" ]]; then
        echo "🔑 Generating new encryption key: $key_name"
        generate_secure_key "$key_name"
    fi
    
    local password
    password=$(cat "$key_file")
    
    echo "🔒 Enterprise encryption starting..."
    echo "  Algorithm: $algorithm"
    echo "  Input: $input_file"
    echo "  Output: $output_file"
    echo "  Key: $key_name"
    
    # Create metadata file
    local metadata_file="${output_file}.meta"
    cat > "$metadata_file" << EOF
{
    "algorithm": "$algorithm",
    "key_name": "$key_name",
    "encrypted_by": "$(whoami)",
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "hostname": "$(hostname)",
    "compliance_mode": "$COMPLIANCE_MODE",
    "file_size": $(stat -f%z "$input_file"),
    "original_name": "$(basename "$input_file")"
}
EOF
    
    # Perform encryption
    if openssl "$algorithm" -salt -in "$input_file" -out "$output_file" -pass file:"$key_file"; then
        # Generate integrity hash
        local hash
        hash=$(shasum -a 256 "$output_file" | cut -d' ' -f1)
        echo "  \"integrity_hash\": \"$hash\"" >> "$metadata_file"
        
        log_action "File encrypted: $input_file -> $output_file (key: $key_name)"
        audit_log "ENCRYPT: $input_file -> $output_file by $(whoami) using $key_name"
        
        echo "✅ Enterprise encryption completed"
        echo "  Metadata: $metadata_file"
        
        # Backup key if enabled
        if [[ "$AUTO_BACKUP_KEYS" == "true" ]]; then
            backup_key "$key_name"
        fi
        
        return 0
    else
        echo "❌ Encryption failed"
        log_action "Encryption failed: $input_file"
        return 1
    fi
}

# Decrypt file with enterprise features
enterprise_decrypt() {
    local input_file="$1"
    local output_file="$2"
    local key_name="$3"
    
    # Check if encrypted file exists
    if [[ ! -f "$input_file" ]]; then
        echo "❌ Encrypted file not found: $input_file"
        return 1
    fi
    
    # Load metadata
    local metadata_file="${input_file}.meta"
    if [[ ! -f "$metadata_file" ]]; then
        echo "⚠️  Metadata file not found, using default algorithm"
        local algorithm="$DEFAULT_ALGORITHM"
    else
        local algorithm
        algorithm=$(grep '"algorithm"' "$metadata_file" | cut -d'"' -f4)
        echo "📋 Loaded metadata: algorithm=$algorithm"
    fi
    
    # Get key
    local key_file="$KEY_STORE/${key_name}.key"
    if [[ ! -f "$key_file" ]]; then
        echo "❌ Decryption key not found: $key_name"
        return 1
    fi
    
    echo "🔓 Enterprise decryption starting..."
    echo "  Algorithm: $algorithm"
    echo "  Input: $input_file"
    echo "  Output: $output_file"
    echo "  Key: $key_name"
    
    # Perform decryption
    if openssl "$algorithm" -d -in "$input_file" -out "$output_file" -pass file:"$key_file"; then
        # Verify integrity if hash available
        if [[ -f "$metadata_file" ]]; then
            verify_integrity "$input_file" "$metadata_file"
        fi
        
        log_action "File decrypted: $input_file -> $output_file (key: $key_name)"
        audit_log "DECRYPT: $input_file -> $output_file by $(whoami) using $key_name"
        
        echo "✅ Enterprise decryption completed"
        return 0
    else
        echo "❌ Decryption failed"
        log_action "Decryption failed: $input_file"
        audit_log "DECRYPT_FAILED: $input_file by $(whoami)"
        return 1
    fi
}

# Verify file integrity
verify_integrity() {
    local encrypted_file="$1"
    local metadata_file="$2"
    
    if [[ -f "$metadata_file" ]]; then
        local stored_hash current_hash
        stored_hash=$(grep '"integrity_hash"' "$metadata_file" | cut -d'"' -f4)
        current_hash=$(shasum -a 256 "$encrypted_file" | cut -d' ' -f1)
        
        if [[ "$stored_hash" == "$current_hash" ]]; then
            echo "✅ File integrity verified"
        else
            echo "⚠️  File integrity check failed - file may be corrupted"
            log_action "Integrity check failed: $encrypted_file"
        fi
    fi
}

# Backup encryption key
backup_key() {
    local key_name="$1"
    local key_file="$KEY_STORE/${key_name}.key"
    local backup_dir="$KEY_STORE/backups"
    
    mkdir -p "$backup_dir"
    
    local backup_file="$backup_dir/${key_name}_$(date +%Y%m%d_%H%M%S).key"
    cp "$key_file" "$backup_file"
    
    log_action "Key backed up: $key_name -> $backup_file"
}

# Generate encryption report
generate_encryption_report() {
    local report_file="/tmp/roundfleet_encryption_report_$(date +%Y%m%d_%H%M%S).txt"
    
    {
        echo "Roundfleet Encryption Management Report"
        echo "===================================="
        echo "Generated: $(date)"
        echo "Hostname: $(hostname)"
        echo "Compliance Mode: $COMPLIANCE_MODE"
        echo ""
        
        echo "Configuration:"
        echo "  Default Algorithm: $DEFAULT_ALGORITHM"
        echo "  Strong Passwords: $REQUIRE_STRONG_PASSWORDS"
        echo "  Min Password Length: $MIN_PASSWORD_LENGTH"
        echo "  Encryption Enabled: $ENCRYPTION_ENABLED"
        echo ""
        
        echo "Available Keys:"
        if ls "$KEY_STORE"/*.key >/dev/null 2>&1; then
            for key_file in "$KEY_STORE"/*.key; do
                local key_name
                key_name=$(basename "$key_file" .key)
                echo "  $key_name ($(stat -f%Sm "$key_file"))"
            done
        else
            echo "  No keys found"
        fi
        echo ""
        
        echo "Recent Encryption Activity:"
        if [[ -f "$AUDIT_LOG" ]]; then
            tail -10 "$AUDIT_LOG"
        else
            echo "  No activity logged"
        fi
        
    } > "$report_file"
    
    echo "📄 Encryption report generated: $report_file"
    log_action "Report generated: $report_file"
}

# Main function
main() {
    case "${1:-status}" in
        "encrypt")
            setup_environment
            load_config
            log_action "=== File Encryption Request ==="
            enterprise_encrypt "$2" "$3" "$4" "$5"
            ;;
        "decrypt")
            setup_environment
            load_config
            log_action "=== File Decryption Request ==="
            enterprise_decrypt "$2" "$3" "$4"
            ;;
        "generate-key")
            setup_environment
            load_config
            log_action "=== Key Generation Request ==="
            generate_secure_key "$2"
            ;;
        "report")
            setup_environment
            load_config
            generate_encryption_report
            ;;
        "list-algorithms")
            echo "📋 Available encryption algorithms:"
            openssl list-cipher-commands | tr ' ' '\n' | sort
            ;;
        "status"|*)
            setup_environment
            load_config
            echo "📊 Roundfleet Encryption Status:"
            echo "=============================="
            echo "Encryption Enabled: $ENCRYPTION_ENABLED"
            echo "Default Algorithm: $DEFAULT_ALGORITHM"
            echo "Compliance Mode: $COMPLIANCE_MODE"
            echo "Key Store: $KEY_STORE"
            
            if ls "$KEY_STORE"/*.key >/dev/null 2>&1; then
                echo "Available Keys: $(ls "$KEY_STORE"/*.key | wc -l)"
            else
                echo "Available Keys: 0"
            fi
            ;;
    esac
}

# Execute main function with parameters
main "$@"

Encryption Algorithms Reference

Quick Comparison

List Available Algorithms

# Display all available encryption algorithms
openssl list-cipher-commands

# Common secure algorithms
openssl enc -ciphers | grep -E "(aes|chacha)"

Security Best Practices

Password Management

#!/bin/bash

# Generate secure password
generate_secure_password() {
    local length="${1:-16}"
    
    # Generate password with mixed characters
    openssl rand -base64 "$length" | tr -d "=+/" | cut -c1-"$length"
}

# Example: Generate 20-character password
secure_password=$(generate_secure_password 20)
echo "Generated password: $secure_password"

Key Rotation

#!/bin/bash

# Rotate encryption keys
rotate_encryption_key() {
    local old_key="$1"
    local new_key="$2"
    local files_dir="$3"
    
    echo "🔄 Rotating encryption key: $old_key -> $new_key"
    
    # Generate new key
    generate_secure_key "$new_key"
    
    # Re-encrypt files with new key
    while IFS= read -r -d '' file; do
        if [[ "$file" == *.enc ]]; then
            local temp_file="/tmp/temp_decrypt_$$"
            
            # Decrypt with old key
            if enterprise_decrypt "$file" "$temp_file" "$old_key"; then
                # Re-encrypt with new key
                if enterprise_encrypt "$temp_file" "$file" "$new_key"; then
                    echo "  ✅ Rotated: $(basename "$file")"
                fi
            fi
            
            # Clean up
            rm -f "$temp_file"
        fi
    done < <(find "$files_dir" -name "*.enc" -type f -print0)
    
    echo "🎉 Key rotation completed"
}

Troubleshooting

Common Issues

1. Encryption fails with "bad decrypt"

   • Verify correct algorithm is used
   • Check password/key file integrity
   • Ensure sufficient disk space

2. Permission denied errors

   • Check file permissions
   • Verify key store access rights
   • Run with appropriate user privileges

3. Corrupted encrypted files

   • Verify file integrity hashes
   • Check for disk errors
   • Restore from backups if available

Verification Commands

# Test encryption/decryption cycle
test_encryption() {
    local test_file="/tmp/test_encrypt.txt"
    local encrypted_file="/tmp/test_encrypt.enc"
    local decrypted_file="/tmp/test_decrypt.txt"
    
    # Create test file
    echo "This is a test file for encryption" > "$test_file"
    
    # Encrypt
    openssl aes-256-cbc -in "$test_file" -out "$encrypted_file" -k "testpassword"
    
    # Decrypt
    openssl aes-256-cbc -d -in "$encrypted_file" -out "$decrypted_file" -k "testpassword"
    
    # Compare
    if diff "$test_file" "$decrypted_file" >/dev/null; then
        echo "✅ Encryption/decryption test passed"
    else
        echo "❌ Encryption/decryption test failed"
    fi
    
    # Cleanup
    rm -f "$test_file" "$encrypted_file" "$decrypted_file"
}

Important Notes

• Algorithm selection: Use AES-256-CBC or stronger for sensitive data
• Password security: Implement strong password policies for enterprise use
• Key management: Securely store and backup encryption keys
• Compliance: Ensure encryption methods meet regulatory requirements
• Performance: Consider file size and system resources when choosing algorithms
• Backup strategy: Always maintain secure backups of encryption keys

Enterprise Deployment

For enterprise deployment, consider:

1. Policy definition - Establish encryption standards and procedures
2. Key management - Implement secure key storage and rotation
3. Compliance monitoring - Ensure adherence to regulatory requirements
4. User training - Educate users on proper encryption practices
5. Audit trails - Maintain comprehensive logs of encryption activities

Discover and manage files across your Roundfleet devices using advanced file search and discovery systems. This tutorial covers file path finding, extension-based searches, content analysis, and comprehensive file lifecycle management.

Understanding macOS File Discovery

macOS provides several file discovery and search capabilities:

• find - Command-line file and directory search utility
• File Path Resolution - Locate specific files by name and extension
• Extension Filtering - Search for files by file type and format
• Content Search - Find files based on content and metadata
• Spotlight Integration - Leverage macOS indexing for fast searches

Basic File Discovery Operations

Find File Path

#!/bin/bash

# Basic file path finding
find / -name 'file name with extension' -print 2>/dev/null

echo "File path search completed"

Enhanced File Discovery

#!/bin/bash

# Comprehensive file discovery with multiple search methods
discover_file_paths() {
    local file_pattern="$1"
    local search_scope="${2:-/}"
    local search_type="${3:-name}"
    
    echo "=== File Discovery and Path Resolution ==="
    echo "Search Pattern: $file_pattern"
    echo "Search Scope: $search_scope"
    echo "Search Type: $search_type"
    
    # Validate search parameters
    if [[ -z "$file_pattern" ]]; then
        echo "❌ File pattern is required"
        return 1
    fi
    
    if [[ ! -d "$search_scope" ]]; then
        echo "❌ Search scope directory not found: $search_scope"
        return 1
    fi
    
    # Perform search based on type
    echo "Starting file discovery..."
    local results_count=0
    
    case "$search_type" in
        "name")
            echo "Searching by filename..."
            find "$search_scope" -name "$file_pattern" -print 2>/dev/null | while read -r file_path; do
                echo "Found: $file_path"
                ((results_count++))
            done
            ;;
        "iname")
            echo "Searching by filename (case-insensitive)..."
            find "$search_scope" -iname "$file_pattern" -print 2>/dev/null | while read -r file_path; do
                echo "Found: $file_path"
                ((results_count++))
            done
            ;;
        "type")
            echo "Searching by file type..."
            find "$search_scope" -type f -name "$file_pattern" -print 2>/dev/null | while read -r file_path; do
                echo "Found: $file_path"
                ((results_count++))
            done
            ;;
        "content")
            echo "Searching by content..."
            grep -r "$file_pattern" "$search_scope" 2>/dev/null | while read -r match; do
                echo "Content match: $match"
                ((results_count++))
            done
            ;;
        *)
            echo "❌ Unknown search type: $search_type"
            return 1
            ;;
    esac
    
    echo "✅ File discovery completed"
    log_discovery_action "$file_pattern" "$search_scope" "$search_type" "success"
    
    return 0
}

# Example usage
# discover_file_paths "document.txt" "/" "name"

List Files by Extension

#!/bin/bash

# Enhanced file extension search
find_files_by_extension() {
    local extension="$1"
    local count="${2:-10}"
    local search_path="${3:-/}"
    
    echo "=== Files by Extension Search ==="
    echo "Extension: .$extension"
    echo "Result Limit: $count"
    echo "Search Path: $search_path"
    
    # Basic extension search
    echo "Searching for .$extension files..."
    find "$search_path" -name "*.$extension" -print 2>/dev/null | head -n "$count"
    
    echo "✅ Extension search completed"
}

# Example usage
# find_files_by_extension "txt" 10 "/"

File Discovery Categories

File Type Classifications

#!/bin/bash

# File discovery categories for different file types and purposes
declare -A FILE_CATEGORIES=(
    ["system_config"]="System configuration files and preferences"
    ["application_data"]="Application data files and user preferences"
    ["media_content"]="Images, videos, audio files and multimedia content"
    ["document_files"]="Text documents, spreadsheets, presentations"
    ["development_code"]="Source code, scripts, development projects"
    ["archive_compressed"]="Compressed archives and backup files"
    ["security_certificates"]="Security certificates, keys, and credentials"
    ["log_diagnostic"]="System logs, diagnostic files, and troubleshooting data"
    ["cache_temporary"]="Cache files, temporary data, and disposable content"
    ["database_structured"]="Database files and structured data storage"
)

# File extensions for each category
declare -A CATEGORY_EXTENSIONS=(
    ["system_config"]="plist,conf,cfg,ini,settings,preferences"
    ["application_data"]="app,dmg,pkg,bundle,framework"
    ["media_content"]="jpg,jpeg,png,gif,mp4,mov,mp3,wav,m4a"
    ["document_files"]="pdf,doc,docx,xls,xlsx,ppt,pptx,txt,rtf"
    ["development_code"]="swift,m,h,py,js,ts,php,java,cpp,c"
    ["archive_compressed"]="zip,tar,gz,bz2,rar,7z,dmg"
    ["security_certificates"]="p12,pem,crt,key,keychain,cer"
    ["log_diagnostic"]="log,crash,diag,report,trace"
    ["cache_temporary"]="cache,tmp,temp,bak,swp"
    ["database_structured"]="db,sqlite,sql,json,xml,csv"
)

# Search priorities for different categories
declare -A SEARCH_PRIORITIES=(
    ["system_config"]="high"
    ["application_data"]="medium"
    ["media_content"]="low"
    ["document_files"]="high"
    ["development_code"]="medium"
    ["archive_compressed"]="low"
    ["security_certificates"]="critical"
    ["log_diagnostic"]="medium"
    ["cache_temporary"]="low"
    ["database_structured"]="high"
)

print_file_categories() {
    echo "=== File Discovery Categories ==="
    for category in "${!FILE_CATEGORIES[@]}"; do
        echo "Category: $category"
        echo "  Description: ${FILE_CATEGORIES[$category]}"
        echo "  Extensions: ${CATEGORY_EXTENSIONS[$category]}"
        echo "  Priority: ${SEARCH_PRIORITIES[$category]}"
        echo ""
    done
}

# Display available categories
print_file_categories

File Discovery Policies

Search and Discovery Policies

#!/bin/bash

# File discovery policies for different organizational requirements
declare -A DISCOVERY_POLICIES=(
    ["security_audit"]="Security-focused file discovery with comprehensive scanning"
    ["compliance_gdpr"]="GDPR compliance file discovery for personal data identification"
    ["asset_inventory"]="Complete asset inventory and file cataloging"
    ["performance_cleanup"]="Performance optimization through file cleanup identification"
    ["backup_verification"]="Backup verification and data integrity checking"
    ["forensic_investigation"]="Forensic file discovery for incident investigation"
)

# Get discovery policy configuration
get_discovery_policy() {
    local policy_type="$1"
    
    case "$policy_type" in
        "security_audit")
            cat << EOF
{
    "discovery_enabled": true,
    "search_scope": "comprehensive",
    "file_types_priority": ["security_certificates", "system_config", "log_diagnostic"],
    "content_analysis": true,
    "metadata_collection": true,
    "permission_analysis": true,
    "hash_verification": true,
    "access_tracking": true,
    "encryption_detection": true,
    "suspicious_patterns": ["password", "key", "token", "secret"],
    "reporting_level": "detailed",
    "audit_logging": "comprehensive",
    "real_time_monitoring": true
}
EOF
            ;;
        "compliance_gdpr")
            cat << EOF
{
    "discovery_enabled": true,
    "search_scope": "user_data_focused",
    "file_types_priority": ["document_files", "database_structured", "application_data"],
    "content_analysis": true,
    "metadata_collection": true,
    "personal_data_detection": true,
    "data_classification": true,
    "retention_analysis": true,
    "consent_tracking": false,
    "data_subject_identification": true,
    "cross_border_analysis": true,
    "privacy_patterns": ["email", "phone", "ssn", "passport", "address"],
    "reporting_level": "privacy_compliant",
    "audit_logging": "gdpr_compliant",
    "data_mapping": true
}
EOF
            ;;
        "asset_inventory")
            cat << EOF
{
    "discovery_enabled": true,
    "search_scope": "complete_system",
    "file_types_priority": ["application_data", "system_config", "document_files"],
    "content_analysis": false,
    "metadata_collection": true,
    "size_analysis": true,
    "modification_tracking": true,
    "ownership_analysis": true,
    "version_detection": true,
    "license_compliance": true,
    "duplicate_detection": true,
    "storage_optimization": true,
    "reporting_level": "inventory_focused",
    "audit_logging": "standard",
    "cataloging": true
}
EOF
            ;;
        "forensic_investigation")
            cat << EOF
{
    "discovery_enabled": true,
    "search_scope": "forensic_complete",
    "file_types_priority": ["all_types"],
    "content_analysis": true,
    "metadata_collection": true,
    "timeline_analysis": true,
    "hash_verification": true,
    "signature_analysis": true,
    "deleted_file_recovery": true,
    "steganography_detection": true,
    "network_artifact_analysis": true,
    "chain_of_custody": true,
    "evidence_preservation": true,
    "reporting_level": "forensic_detailed",
    "audit_logging": "forensic_compliant",
    "legal_hold": true
}
EOF
            ;;
        *)
            echo "Unknown discovery policy: $policy_type"
            return 1
            ;;
    esac
}

# Apply discovery policy
apply_discovery_policy() {
    local policy="$1"
    local config_file="/tmp/discovery_policy.json"
    
    echo "Applying file discovery policy: $policy"
    
    get_discovery_policy "$policy" > "$config_file"
    
    if [[ ! -f "$config_file" ]]; then
        echo "❌ Failed to generate policy configuration"
        return 1
    fi
    
    echo "✅ File discovery policy applied successfully"
    echo "Configuration: $config_file"
    
    # Display key policy settings
    echo "=== Policy Summary ==="
    echo "Discovery Enabled: $(jq -r '.discovery_enabled' "$config_file")"
    echo "Search Scope: $(jq -r '.search_scope' "$config_file")"
    echo "Content Analysis: $(jq -r '.content_analysis' "$config_file")"
    echo "Metadata Collection: $(jq -r '.metadata_collection' "$config_file")"
    echo "Reporting Level: $(jq -r '.reporting_level' "$config_file")"
    
    return 0
}

Advanced File Discovery and Analysis

Comprehensive File Discovery System

#!/bin/bash

# Advanced file discovery with content analysis and metadata extraction
advanced_file_discovery() {
    local search_criteria="$1"
    local analysis_level="${2:-standard}"
    local output_format="${3:-text}"
    
    echo "=== Advanced File Discovery System ==="
    echo "Search Criteria: $search_criteria"
    echo "Analysis Level: $analysis_level"
    echo "Output Format: $output_format"
    
    local discovery_report="/tmp/file_discovery_$(date +%Y%m%d_%H%M%S).json"
    
    # Initialize discovery report
    cat > "$discovery_report" << EOF
{
    "discovery_session": {
        "search_criteria": "$search_criteria",
        "analysis_level": "$analysis_level",
        "timestamp": "$(date -Iseconds)",
        "hostname": "$(hostname)",
        "operator": "$(whoami)"
    },
    "discovered_files": [],
    "file_statistics": {},
    "content_analysis": {},
    "security_findings": {}
}
EOF
    
    # Perform comprehensive file discovery
    echo "Performing comprehensive file search..."
    
    # Search by multiple criteria
    local files_found=0
    
    # Basic filename search
    echo "  - Searching by filename patterns..."
    find / -name "*$search_criteria*" -type f -print 2>/dev/null | while read -r file_path; do
        analyze_discovered_file "$file_path" "$analysis_level" "$discovery_report"
        ((files_found++))
    done
    
    # Content-based search
    if [[ "$analysis_level" == "comprehensive" ]]; then
        echo "  - Performing content analysis..."
        grep -r "$search_criteria" / 2>/dev/null | head -100 | while read -r match; do
            local file_path
            file_path=$(echo "$match" | cut -d':' -f1)
            analyze_discovered_file "$file_path" "$analysis_level" "$discovery_report"
        done
    fi
    
    # Generate file statistics
    generate_file_statistics "$discovery_report"
    
    # Display results
    echo ""
    echo "Discovery Results:"
    echo "  Files Found: $files_found"
    echo "  Discovery Report: $discovery_report"
    
    # Format output
    case "$output_format" in
        "json")
            cat "$discovery_report"
            ;;
        "summary")
            jq -r '.discovery_session, .file_statistics' "$discovery_report"
            ;;
        *)
            echo "Discovery completed - see report file for details"
            ;;
    esac
    
    return 0
}

# Analyze discovered file
analyze_discovered_file() {
    local file_path="$1"
    local analysis_level="$2"
    local report_file="$3"
    
    if [[ ! -f "$file_path" ]]; then
        return 1
    fi
    
    # Basic file information
    local file_size
    file_size=$(stat -f%z "$file_path" 2>/dev/null || echo "0")
    local file_permissions
    file_permissions=$(stat -f%A "$file_path" 2>/dev/null || echo "unknown")
    local file_owner
    file_owner=$(stat -f%Su "$file_path" 2>/dev/null || echo "unknown")
    local modification_time
    modification_time=$(stat -f%Sm "$file_path" 2>/dev/null || echo "unknown")
    
    # Enhanced analysis for comprehensive level
    local file_type="unknown"
    local content_preview=""
    local security_flags=""
    
    if [[ "$analysis_level" == "comprehensive" ]]; then
        file_type=$(file -b "$file_path" 2>/dev/null || echo "unknown")
        
        # Safe content preview for text files
        if file "$file_path" | grep -q "text"; then
            content_preview=$(head -c 200 "$file_path" 2>/dev/null | tr '\n' ' ')
        fi
        
        # Security analysis
        if [[ "$file_permissions" =~ 7.* ]]; then
            security_flags="executable_by_owner"
        fi
        
        if [[ "$file_path" =~ \.key$|\.pem$|\.p12$ ]]; then
            security_flags="${security_flags},potential_security_credential"
        fi
    fi
    
    # Log file discovery
    log_discovered_file "$file_path" "$file_size" "$file_type" "$security_flags"
}

# Generate file statistics
generate_file_statistics() {
    local report_file="$1"
    
    # Calculate basic statistics
    local total_files_found=0
    local total_size=0
    local file_types=()
    
    # Update report with statistics
    jq --argjson total_files "$total_files_found" \
       --argjson total_size "$total_size" \
       '.file_statistics = {
          "total_files_found": $total_files,
          "total_size_bytes": $total_size,
          "analysis_timestamp": "'$(date -Iseconds)'"
        }' "$report_file" > "${report_file}.tmp" && mv "${report_file}.tmp" "$report_file"
}

# Log discovered file
log_discovered_file() {
    local file_path="$1"
    local file_size="$2"
    local file_type="$3"
    local security_flags="$4"
    
    echo "$(date '+%Y-%m-%d %H:%M:%S') - File Discovered: $file_path (Size: $file_size, Type: $file_type, Security: $security_flags)" >> "/var/log/roundfleet_file_discovery.log"
}

File Discovery Management System

#!/bin/bash

# Roundfleet File Discovery and Search Management System
# Comprehensive file discovery, cataloging, and management

# Configuration
CONFIG_DIR="/etc/roundfleet/discovery"
LOG_FILE="/var/log/roundfleet_file_discovery.log"
DATA_DIR="/var/data/roundfleet/discovery"
REPORTS_DIR="/var/reports/roundfleet/discovery"
AUDIT_LOG="/var/log/roundfleet_discovery_audit.log"
INDEX_DIR="/var/index/roundfleet/discovery"

# Create required directories
create_directories() {
    local directories=("$CONFIG_DIR" "$DATA_DIR" "$REPORTS_DIR" "$INDEX_DIR")
    
    for dir in "${directories[@]}"; do
        if [[ ! -d "$dir" ]]; then
            sudo mkdir -p "$dir"
            sudo chmod 755 "$dir"
        fi
    done
}

# Logging functions
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') [INFO] $1" | tee -a "$LOG_FILE"
}

log_error() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') [ERROR] $1" | tee -a "$LOG_FILE" >&2
}

audit_log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') [AUDIT] $1" | tee -a "$AUDIT_LOG"
}

# File system indexing
create_file_index() {
    local index_scope="${1:-/Users}"
    local index_level="${2:-standard}"
    
    log_action "Creating file system index: $index_scope (Level: $index_level)"
    
    echo "=== File System Indexing ==="
    echo "Index Scope: $index_scope"
    echo "Index Level: $index_level"
    
    local index_file="$INDEX_DIR/file_index_$(date +%Y%m%d_%H%M%S).json"
    
    # Initialize index
    cat > "$index_file" << EOF
{
    "index_metadata": {
        "scope": "$index_scope",
        "level": "$index_level",
        "created": "$(date -Iseconds)",
        "hostname": "$(hostname)",
        "total_files": 0,
        "total_size": 0
    },
    "file_entries": []
}
EOF
    
    echo "Starting file system indexing..."
    local file_count=0
    local total_size=0
    
    # Index files based on level
    case "$index_level" in
        "basic")
            find "$index_scope" -type f -print 2>/dev/null | while read -r file_path; do
                index_file_basic "$file_path" "$index_file"
                ((file_count++))
                
                if [[ $((file_count % 1000)) -eq 0 ]]; then
                    echo "  Indexed $file_count files..."
                fi
            done
            ;;
        "standard")
            find "$index_scope" -type f -print 2>/dev/null | while read -r file_path; do
                index_file_standard "$file_path" "$index_file"
                ((file_count++))
                
                if [[ $((file_count % 500)) -eq 0 ]]; then
                    echo "  Indexed $file_count files..."
                fi
            done
            ;;
        "comprehensive")
            find "$index_scope" -type f -print 2>/dev/null | while read -r file_path; do
                index_file_comprehensive "$file_path" "$index_file"
                ((file_count++))
                
                if [[ $((file_count % 100)) -eq 0 ]]; then
                    echo "  Indexed $file_count files..."
                fi
            done
            ;;
        *)
            echo "❌ Unknown index level: $index_level"
            return 1
            ;;
    esac
    
    echo "✅ File system indexing completed"
    echo "  Files Indexed: $file_count"
    echo "  Index File: $index_file"
    
    audit_log "File system index created: $index_scope ($file_count files)"
    
    return 0
}

# Index file with basic information
index_file_basic() {
    local file_path="$1"
    local index_file="$2"
    
    if [[ ! -f "$file_path" ]]; then
        return 1
    fi
    
    local file_size
    file_size=$(stat -f%z "$file_path" 2>/dev/null || echo "0")
    local modification_time
    modification_time=$(stat -f%Sm "$file_path" 2>/dev/null || echo "unknown")
    
    # Basic indexing (minimal overhead)
    echo "Indexed: $file_path" >> "${index_file}.basic_log"
}

# Index file with standard information
index_file_standard() {
    local file_path="$1"
    local index_file="$2"
    
    if [[ ! -f "$file_path" ]]; then
        return 1
    fi
    
    local file_size
    file_size=$(stat -f%z "$file_path" 2>/dev/null || echo "0")
    local file_permissions
    file_permissions=$(stat -f%A "$file_path" 2>/dev/null || echo "unknown")
    local file_owner
    file_owner=$(stat -f%Su "$file_path" 2>/dev/null || echo "unknown")
    local file_extension
    file_extension="${file_path##*.}"
    
    # Standard indexing with metadata
    echo "$(date -Iseconds),$file_path,$file_size,$file_permissions,$file_owner,$file_extension" >> "${index_file}.csv"
}

# Index file with comprehensive information
index_file_comprehensive() {
    local file_path="$1"
    local index_file="$2"
    
    if [[ ! -f "$file_path" ]]; then
        return 1
    fi
    
    # Comprehensive file analysis
    local file_info
    file_info=$(analyze_file_comprehensive "$file_path")
    
    # Store in detailed format
    echo "$file_info" >> "${index_file}.detailed_log"
}

# Comprehensive file analysis
analyze_file_comprehensive() {
    local file_path="$1"
    
    # Gather all available file information
    local file_size
    file_size=$(stat -f%z "$file_path" 2>/dev/null || echo "0")
    local file_type
    file_type=$(file -b "$file_path" 2>/dev/null || echo "unknown")
    local file_hash
    file_hash=$(shasum -a 256 "$file_path" 2>/dev/null | cut -d' ' -f1 || echo "unknown")
    
    echo "Path:$file_path|Size:$file_size|Type:$file_type|Hash:$file_hash|Timestamp:$(date -Iseconds)"
}

# Search indexed files
search_file_index() {
    local search_term="$1"
    local search_type="${2:-name}"
    local index_scope="${3:-latest}"
    
    log_action "Searching file index: $search_term (Type: $search_type)"
    
    echo "=== Indexed File Search ==="
    echo "Search Term: $search_term"
    echo "Search Type: $search_type"
    echo "Index Scope: $index_scope"
    
    # Find the appropriate index file
    local index_file
    if [[ "$index_scope" == "latest" ]]; then
        index_file=$(ls -t "$INDEX_DIR"/file_index_*.json 2>/dev/null | head -1)
    else
        index_file="$INDEX_DIR/$index_scope"
    fi
    
    if [[ ! -f "$index_file" ]]; then
        echo "❌ No index file found"
        return 1
    fi
    
    echo "Using index: $index_file"
    
    # Perform search based on type
    case "$search_type" in
        "name")
            grep -i "$search_term" "${index_file}.csv" 2>/dev/null | head -20
            ;;
        "extension")
            grep ",$search_term$" "${index_file}.csv" 2>/dev/null | head -20
            ;;
        "size")
            # Search by file size range
            echo "Size-based search not implemented in basic version"
            ;;
        *)
            echo "❌ Unknown search type: $search_type"
            return 1
            ;;
    esac
    
    audit_log "Index search completed: $search_term ($search_type)"
    
    return 0
}

# Generate discovery report
generate_discovery_report() {
    local report_type="$1"
    local scope="${2:-system}"
    
    log_action "Generating discovery report: $report_type (Scope: $scope)"
    
    echo "=== File Discovery Report Generation ==="
    echo "Report Type: $report_type"
    echo "Scope: $scope"
    
    local report_file="$REPORTS_DIR/discovery_report_${report_type}_$(date +%Y%m%d_%H%M%S).json"
    
    case "$report_type" in
        "summary")
            generate_summary_report "$scope" "$report_file"
            ;;
        "detailed")
            generate_detailed_report "$scope" "$report_file"
            ;;
        "security")
            generate_security_report "$scope" "$report_file"
            ;;
        "compliance")
            generate_compliance_report "$scope" "$report_file"
            ;;
        *)
            echo "❌ Unknown report type: $report_type"
            return 1
            ;;
    esac
    
    echo "✅ Discovery report generated: $report_file"
    audit_log "Discovery report generated: $report_type for $scope"
    
    return 0
}

# Generate summary report
generate_summary_report() {
    local scope="$1"
    local report_file="$2"
    
    # Collect basic statistics
    local total_files
    total_files=$(find "$scope" -type f 2>/dev/null | wc -l | tr -d ' ')
    local total_directories
    total_directories=$(find "$scope" -type d 2>/dev/null | wc -l | tr -d ' ')
    
    cat > "$report_file" << EOF
{
    "report_type": "summary",
    "scope": "$scope",
    "generated": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "statistics": {
        "total_files": $total_files,
        "total_directories": $total_directories
    }
}
EOF
}

# Main function with command routing
main() {
    local command="$1"
    shift
    
    # Initialize
    create_directories
    
    case "$command" in
        "find_file")
            # Find specific file by name
            discover_file_paths "$@"
            ;;
        "find_extension")
            # Find files by extension
            find_files_by_extension "$@"
            ;;
        "advanced_search")
            # Advanced file discovery
            advanced_file_discovery "$@"
            ;;
        "create_index")
            # Create file system index
            create_file_index "$@"
            ;;
        "search_index")
            # Search existing index
            search_file_index "$@"
            ;;
        "apply_policy")
            # Apply discovery policy
            apply_discovery_policy "$@"
            ;;
        "generate_report")
            # Generate discovery report
            generate_discovery_report "$@"
            ;;
        "show_categories")
            # Show file categories
            print_file_categories
            ;;
        "show_policies")
            # Show available policies
            for policy in security_audit compliance_gdpr asset_inventory performance_cleanup backup_verification forensic_investigation; do
                echo "Policy: $policy"
                get_discovery_policy "$policy" | jq .
                echo ""
            done
            ;;
        *)
            echo "Roundfleet File Discovery and Search Management System"
            echo "Usage: $0 <command> [options]"
            echo ""
            echo "Commands:"
            echo "  find_file <pattern> [scope] [type]                - Find specific files by pattern"
            echo "  find_extension <ext> [count] [path]               - Find files by extension"
            echo "  advanced_search <criteria> [level] [format]      - Advanced file discovery"
            echo "  create_index [scope] [level]                     - Create file system index"
            echo "  search_index <term> [type] [scope]               - Search existing index"
            echo "  apply_policy <policy>                            - Apply discovery policy"
            echo "  generate_report <type> [scope]                   - Generate discovery report"
            echo "  show_categories                                  - Show file categories"
            echo "  show_policies                                    - Show discovery policies"
            echo ""
            echo "Examples:"
            echo "  $0 find_file \"document.txt\" \"/Users\" \"name\""
            echo "  $0 find_extension \"pdf\" 20 \"/Users\""
            echo "  $0 advanced_search \"config\" \"comprehensive\" \"json\""
            echo "  $0 create_index \"/Users\" \"standard\""
            echo "  $0 search_index \"report\" \"name\" \"latest\""
            echo "  $0 apply_policy \"security_audit\""
            echo "  $0 generate_report \"summary\" \"/Users\""
            ;;
    esac
}

# Execute main function with all arguments
main "$@"

Security Considerations

File Discovery Security

• Access Controls - Respect file permissions and access restrictions
• Sensitive Data Protection - Avoid exposing sensitive file contents in logs
• Performance Impact - Monitor system performance during large-scale discovery
• Privacy Compliance - Ensure discovery practices comply with privacy regulations
• Audit Trails - Maintain comprehensive logs of discovery activities

Compliance Framework

• Data Classification - Properly classify discovered files based on sensitivity
• Retention Policies - Implement appropriate data retention and disposal
• Access Logging - Log all file access and discovery activities
• Privacy Protection - Protect personal and sensitive information during discovery
• Regulatory Compliance - Meet industry-specific discovery and cataloging requirements

Troubleshooting Guide

Common Issues

Permission Denied Errors

• Run discovery with appropriate privileges: sudo for system-wide searches
• Check file and directory permissions: ls -la
• Verify search scope accessibility

Slow Search Performance

• Limit search scope to specific directories
• Use indexed searches for frequently accessed data
• Consider search criteria specificity

Too Many Results

• Use more specific search patterns
• Implement result limits with head -n <count>
• Filter by file type or date ranges

Diagnostic Commands

# Test basic find functionality
find /Users -name "*.txt" -print 2>/dev/null | head -5

# Check file system permissions
ls -la /path/to/search/directory

# Monitor search performance
time find /Users -name "pattern" -print 2>/dev/null

# Check available disk space for indexing
df -h

Important Notes

• File Path Escaping - Use quotes or backslashes for paths with spaces: "New Folder/file.txt" or New\ Folder/file.txt
• Search Scope - Broader searches take longer but provide more complete results
• System Impact - Large-scale file discovery can impact system performance
• Result Limits - Use appropriate limits to prevent overwhelming output
• Index Maintenance - Regularly update file indexes for accuracy
• Security Awareness - Be cautious when searching for sensitive files and credentials

Implement enterprise-grade file and folder deletion management across your Roundfleet deployment with secure data removal, audit trails, backup protection, compliance management, and automated cleanup operations. This tutorial provides solutions for maintaining data hygiene while ensuring security, compliance, and data protection.

Understanding macOS File Deletion Management

macOS provides several methods for file and folder deletion:

• rm - Remove files and directories from command line
• rm -r - Recursive deletion for directories with contents
• rm -f - Force deletion without confirmation prompts
• Finder - GUI-based trash/delete operations
• srm - Secure deletion with data overwriting (legacy)

Basic File Deletion Operations

Simple File/Folder Deletion

#!/bin/bash

# Basic file deletion
rm '/path to the file or folder'

Recursive Directory Deletion

#!/bin/bash

# Recursive folder deletion
rm -rf /Users/username/Desktop/My\ Files

Delete Folder Contents Only

#!/bin/bash

# Delete folder contents
rm '/path to the folder/*'

Multiple File Deletion

#!/bin/bash

# Delete multiple specific files
rm Desktop/1.png Desktop/2.png

# Delete files by pattern
rm Desktop/{1,2}.png

# Delete all files of type
rm Desktop/*.png

Enterprise File Deletion Management System

#!/bin/bash

# Roundfleet Enterprise File and Folder Deletion Management Tool
# Secure data removal with compliance and audit capabilities

# Configuration
CONFIG_FILE="/etc/roundfleet/file_deletion_policy.conf"
LOG_FILE="/var/log/roundfleet_file_deletion.log"
BACKUP_DIR="/Library/Roundfleet/DeletedFiles"
AUDIT_LOG="/var/log/roundfleet_deletion_audit.log"
QUARANTINE_DIR="/Library/Roundfleet/QuarantinedFiles"

# Create directories
mkdir -p "$(dirname "$CONFIG_FILE")" "$(dirname "$LOG_FILE")" "$BACKUP_DIR" "$(dirname "$AUDIT_LOG")" "$QUARANTINE_DIR"

# Default file deletion management policy
cat > "$CONFIG_FILE" 2>/dev/null << 'EOF' || true
# Roundfleet Enterprise File Deletion Management Policy
# Version: 2.0

# Deletion Policy Enforcement
ENFORCE_DELETION_POLICIES=true
REQUIRE_BACKUP_BEFORE_DELETE=true
SECURE_DELETION_ENABLED=true
PREVENT_SYSTEM_FILE_DELETION=true
BUSINESS_HOURS_PROTECTION=true

# Security and Data Protection
REQUIRE_ADMIN_APPROVAL=false
VALIDATE_FILE_PERMISSIONS=true
PROTECTED_DIRECTORIES_ENFORCEMENT=true
MALWARE_QUARANTINE_CHECK=true
SENSITIVE_DATA_DETECTION=true

# Backup and Recovery
AUTOMATIC_BACKUP_ENABLED=true
BACKUP_RETENTION_DAYS=30
COMPRESSED_BACKUPS=true
ENCRYPTED_BACKUPS=true
RECOVERY_VALIDATION=true

# Compliance and Audit
AUDIT_ALL_DELETIONS=true
COMPLIANCE_REPORTING=true
INCIDENT_DOCUMENTATION=true
GDPR_COMPLIANCE=true
DATA_CLASSIFICATION_AWARE=true

# User Experience
USER_NOTIFICATION_ENABLED=true
DELETION_CONFIRMATION=true
PROGRESS_MONITORING=true
BATCH_OPERATION_SUPPORT=true
ROLLBACK_CAPABILITY=true

# Performance and Safety
DELETION_TIMEOUT=300
MAX_CONCURRENT_DELETIONS=5
SIZE_LIMIT_CHECK=true
FREE_SPACE_MONITORING=true
SYSTEM_LOAD_MONITORING=true
EOF

# Source configuration
source "$CONFIG_FILE" 2>/dev/null || true

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Audit logging function
audit_log() {
    local action="$1"
    local file_path="$2"
    local result="$3"
    local details="$4"
    echo "$(date '+%Y-%m-%d %H:%M:%S') - ACTION:$action FILE:$file_path RESULT:$result DETAILS:$details USER:$(whoami) SIZE:$(get_file_size "$file_path")" >> "$AUDIT_LOG"
}

# Get file size for audit
get_file_size() {
    local file_path="$1"
    if [[ -e "$file_path" ]]; then
        du -sh "$file_path" 2>/dev/null | awk '{print $1}' || echo "unknown"
    else
        echo "0"
    fi
}

# Validate file deletion safety
validate_deletion_safety() {
    local file_path="$1"
    local force="${2:-false}"
    
    echo "=== File Deletion Safety Validation ==="
    
    # Check if file/directory exists
    if [[ ! -e "$file_path" ]]; then
        echo "❌ File or directory not found: $file_path"
        audit_log "VALIDATION" "$file_path" "NOT_FOUND" "File or directory does not exist"
        return 1
    fi
    
    echo "✅ File/directory found: $file_path"
    
    # Prevent system file deletion
    if [[ "$PREVENT_SYSTEM_FILE_DELETION" == "true" ]]; then
        local protected_paths=(
            "/System"
            "/Library/System"
            "/usr/bin"
            "/usr/sbin"
            "/bin"
            "/sbin"
            "/var/db"
            "/private/var/db"
            "/Applications/Utilities"
        )
        
        for protected_path in "${protected_paths[@]}"; do
            if [[ "$file_path" == "$protected_path"* ]]; then
                echo "❌ Cannot delete protected system path: $file_path"
                audit_log "VALIDATION" "$file_path" "PROTECTED_PATH" "System file deletion blocked"
                return 1
            fi
        done
    fi
    
    # Check protected directories
    if [[ "$PROTECTED_DIRECTORIES_ENFORCEMENT" == "true" && "$force" != "true" ]]; then
        local protected_dirs=(
            "/Users/*/Documents/Important"
            "/Users/*/Desktop/Critical"
            "/Library/Roundfleet/Config"
            "/etc"
            "/Applications"
        )
        
        for protected_dir in "${protected_dirs[@]}"; do
            if [[ "$file_path" == $protected_dir* ]]; then
                echo "❌ File in protected directory: $file_path"
                audit_log "VALIDATION" "$file_path" "PROTECTED_DIR" "Protected directory access blocked"
                return 1
            fi
        done
    fi
    
    # Business hours protection for user data
    if [[ "$BUSINESS_HOURS_PROTECTION" == "true" && "$force" != "true" ]]; then
        local current_hour
        current_hour=$(date +%H)
        local current_day
        current_day=$(date +%u)  # 1=Monday, 7=Sunday
        
        if [[ $current_day -ge 1 && $current_day -le 5 && $current_hour -ge 9 && $current_hour -lt 18 ]]; then
            if [[ "$file_path" == "/Users/"* ]]; then
                echo "⚠️  Business hours protection: User data deletion restricted"
                audit_log "VALIDATION" "$file_path" "BUSINESS_HOURS" "User data deletion blocked during business hours"
                return 1
            fi
        fi
    fi
    
    # Check file permissions
    if [[ "$VALIDATE_FILE_PERMISSIONS" == "true" ]]; then
        if [[ ! -w "$file_path" && ! -w "$(dirname "$file_path")" ]]; then
            echo "❌ Insufficient permissions to delete: $file_path"
            audit_log "VALIDATION" "$file_path" "NO_PERMISSION" "Insufficient permissions for deletion"
            return 1
        fi
    fi
    
    # Sensitive data detection
    if [[ "$SENSITIVE_DATA_DETECTION" == "true" ]]; then
        if detect_sensitive_data "$file_path"; then
            echo "⚠️  Sensitive data detected in: $file_path"
            if [[ "$force" != "true" ]]; then
                audit_log "VALIDATION" "$file_path" "SENSITIVE_DATA" "Sensitive data deletion requires force flag"
                return 1
            fi
        fi
    fi
    
    audit_log "VALIDATION" "$file_path" "PASSED" "All safety checks passed"
    return 0
}

# Detect sensitive data in files
detect_sensitive_data() {
    local file_path="$1"
    
    if [[ -f "$file_path" ]]; then
        # Check for common sensitive data patterns
        local sensitive_patterns=(
            "\b\d{3}-\d{2}-\d{4}\b"  # SSN pattern
            "\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b"  # Credit card pattern
            "password"
            "secret"
            "private.*key"
            "confidential"
        )
        
        for pattern in "${sensitive_patterns[@]}"; do
            if grep -qi "$pattern" "$file_path" 2>/dev/null; then
                return 0  # Sensitive data found
            fi
        done
    fi
    
    return 1  # No sensitive data found
}

# Create backup before deletion
create_backup() {
    local file_path="$1"
    local backup_reason="${2:-deletion}"
    
    if [[ "$AUTOMATIC_BACKUP_ENABLED" != "true" ]]; then
        return 0
    fi
    
    echo "=== Creating Backup ==="
    
    local backup_timestamp
    backup_timestamp=$(date +%Y%m%d_%H%M%S)
    local backup_name
    backup_name="$(basename "$file_path")_${backup_timestamp}_${backup_reason}"
    local backup_path="$BACKUP_DIR/$backup_name"
    
    # Create backup directory structure
    mkdir -p "$BACKUP_DIR"
    
    # Copy file/directory to backup location
    if [[ -d "$file_path" ]]; then
        # Directory backup
        if [[ "$COMPRESSED_BACKUPS" == "true" ]]; then
            tar -czf "${backup_path}.tar.gz" -C "$(dirname "$file_path")" "$(basename "$file_path")" 2>/dev/null
            backup_path="${backup_path}.tar.gz"
        else
            cp -R "$file_path" "$backup_path" 2>/dev/null
        fi
    else
        # File backup
        if [[ "$COMPRESSED_BACKUPS" == "true" && $(stat -f%z "$file_path" 2>/dev/null || echo 0) -gt 1048576 ]]; then
            gzip -c "$file_path" > "${backup_path}.gz" 2>/dev/null
            backup_path="${backup_path}.gz"
        else
            cp "$file_path" "$backup_path" 2>/dev/null
        fi
    fi
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Backup created: $backup_path"
        
        # Encrypt backup if enabled
        if [[ "$ENCRYPTED_BACKUPS" == "true" ]]; then
            encrypt_backup "$backup_path"
        fi
        
        # Record backup in metadata
        echo "$(date -u +%Y-%m-%dT%H:%M:%SZ)|$file_path|$backup_path|$backup_reason" >> "$BACKUP_DIR/backup_manifest.log"
        
        log_action "Backup created for $file_path at $backup_path"
        audit_log "BACKUP" "$file_path" "CREATED" "Backup path: $backup_path"
        
        return 0
    else
        echo "❌ Failed to create backup for: $file_path"
        log_action "FAILED: Backup creation failed for $file_path"
        audit_log "BACKUP" "$file_path" "FAILED" "Backup creation error"
        return 1
    fi
}

# Encrypt backup file
encrypt_backup() {
    local backup_path="$1"
    
    # Simple encryption using built-in tools (in production, use proper enterprise encryption)
    if command -v openssl >/dev/null 2>&1; then
        openssl enc -aes-256-cbc -salt -in "$backup_path" -out "${backup_path}.enc" -k "Roundfleet_Backup_Key_$(date +%Y)" 2>/dev/null
        if [[ $? -eq 0 ]]; then
            rm "$backup_path"
            echo "🔐 Backup encrypted: ${backup_path}.enc"
            log_action "Backup encrypted: ${backup_path}.enc"
        fi
    fi
}

# Secure file deletion
secure_delete() {
    local file_path="$1"
    local secure_passes="${2:-3}"
    
    echo "=== Secure Deletion Process ==="
    
    if [[ ! -e "$file_path" ]]; then
        echo "❌ File not found for secure deletion: $file_path"
        return 1
    fi
    
    local file_size
    file_size=$(get_file_size "$file_path")
    
    # For files, perform secure overwrite before deletion
    if [[ -f "$file_path" && "$SECURE_DELETION_ENABLED" == "true" ]]; then
        echo "🔐 Performing secure deletion with $secure_passes passes..."
        
        # Multiple pass overwrite
        for ((pass=1; pass<=secure_passes; pass++)); do
            echo "Pass $pass/$secure_passes: Overwriting with random data..."
            dd if=/dev/urandom of="$file_path" bs=1024 count=$(du -k "$file_path" 2>/dev/null | cut -f1) 2>/dev/null || true
            sync
        done
        
        # Final zero pass
        dd if=/dev/zero of="$file_path" bs=1024 count=$(du -k "$file_path" 2>/dev/null | cut -f1) 2>/dev/null || true
        sync
        
        echo "🔐 Secure overwrite completed"
        audit_log "SECURE_DELETE" "$file_path" "OVERWRITTEN" "Secure overwrite with $secure_passes passes"
    fi
    
    # Perform final deletion
    if [[ -d "$file_path" ]]; then
        # Directory deletion
        rm -rf "$file_path" 2>/dev/null
    else
        # File deletion
        rm -f "$file_path" 2>/dev/null
    fi
    
    local deletion_result=$?
    
    if [[ $deletion_result -eq 0 ]]; then
        echo "✅ File securely deleted: $file_path (Size: $file_size)"
        audit_log "SECURE_DELETE" "$file_path" "SUCCESS" "Secure deletion completed (Size: $file_size)"
        return 0
    else
        echo "❌ Failed to delete: $file_path"
        audit_log "SECURE_DELETE" "$file_path" "FAILED" "Deletion failed"
        return 1
    fi
}

# Enterprise file deletion with comprehensive management
enterprise_file_delete() {
    local file_path="$1"
    local force="${2:-false}"
    local secure="${3:-true}"
    local backup="${4:-true}"
    
    echo "=== Enterprise File Deletion ==="
    
    if [[ -z "$file_path" ]]; then
        echo "❌ File path required"
        return 1
    fi
    
    log_action "ENTERPRISE FILE DELETE: Starting deletion of $file_path"
    
    # Pre-deletion validation
    if ! validate_deletion_safety "$file_path" "$force"; then
        log_action "FAILED: File deletion safety validation failed for $file_path"
        return 1
    fi
    
    # Create backup if required
    if [[ "$backup" == "true" || "$REQUIRE_BACKUP_BEFORE_DELETE" == "true" ]]; then
        if ! create_backup "$file_path" "pre_deletion"; then
            if [[ "$force" != "true" ]]; then
                echo "❌ Backup failed and force mode not enabled"
                return 1
            else
                echo "⚠️  Proceeding without backup (force mode)"
            fi
        fi
    fi
    
    # Check system resources
    check_system_resources
    
    # User confirmation if enabled
    if [[ "$DELETION_CONFIRMATION" == "true" && "$force" != "true" ]]; then
        echo "⚠️  Deletion confirmation required for: $file_path"
        # In automated scripts, this would integrate with approval workflows
        log_action "Deletion confirmation required for $file_path"
    fi
    
    # Perform deletion
    local start_time
    start_time=$(date +%s)
    
    if [[ "$secure" == "true" ]]; then
        secure_delete "$file_path"
    else
        # Standard deletion
        if [[ -d "$file_path" ]]; then
            rm -rf "$file_path" 2>/dev/null
        else
            rm -f "$file_path" 2>/dev/null
        fi
    fi
    
    local deletion_result=$?
    local end_time
    end_time=$(date +%s)
    local duration=$((end_time - start_time))
    
    # Send notifications
    send_deletion_notification "$file_path" "$deletion_result" "$duration"
    
    # Cleanup and verification
    if [[ $deletion_result -eq 0 ]]; then
        echo "✅ File deletion completed successfully: $file_path"
        log_action "SUCCESS: File deleted successfully: $file_path (Duration: ${duration}s)"
        
        # Update usage statistics
        update_deletion_stats "$file_path"
        
        # Cleanup related files
        cleanup_related_files "$file_path"
        
        return 0
    else
        echo "❌ File deletion failed: $file_path"
        log_action "FAILED: Could not delete file: $file_path"
        return 1
    fi
}

# Send deletion notification
send_deletion_notification() {
    local file_path="$1"
    local result="$2"
    local duration="$3"
    
    if [[ "$USER_NOTIFICATION_ENABLED" != "true" ]]; then
        return 0
    fi
    
    echo "=== Sending Deletion Notifications ==="
    
    local notification_title="Roundfleet File Management"
    local result_text="success"
    if [[ $result -ne 0 ]]; then
        result_text="failed"
    fi
    
    local notification_message="File deletion $result_text: $(basename "$file_path") (${duration}s)"
    
    # Display notification to logged-in users
    local logged_users
    logged_users=$(who | awk '{print $1}' | sort -u)
    
    for user in $logged_users; do
        if [[ -n "$user" ]]; then
            sudo -u "$user" osascript -e "display notification \"$notification_message\" with title \"$notification_title\"" 2>/dev/null || true
            echo "📱 Notification sent to user: $user"
        fi
    done
    
    log_action "Deletion notifications sent for $file_path ($result_text)"
}

# Bulk file deletion operations
bulk_file_deletion() {
    local file_list="$1"
    local force="${2:-false}"
    local secure="${3:-true}"
    
    echo "=== Bulk File Deletion Operations ==="
    
    local success_count=0
    local failure_count=0
    local total_count=0
    local total_size=0
    
    # Handle different input types
    if [[ -f "$file_list" ]]; then
        # File list from file
        while IFS= read -r file_path; do
            # Skip empty lines and comments
            if [[ -z "$file_path" || "$file_path" == \#* ]]; then
                continue
            fi
            
            ((total_count++))
            echo "Processing ($total_count): $file_path"
            
            if enterprise_file_delete "$file_path" "$force" "$secure"; then
                ((success_count++))
            else
                ((failure_count++))
            fi
            
            echo "---"
            sleep 1  # Brief pause between operations
        done < "$file_list"
    else
        # Pattern-based deletion
        echo "Pattern-based deletion: $file_list"
        
        # Expand pattern and process each file
        for file_path in $file_list; do
            if [[ -e "$file_path" ]]; then
                ((total_count++))
                echo "Processing ($total_count): $file_path"
                
                if enterprise_file_delete "$file_path" "$force" "$secure"; then
                    ((success_count++))
                else
                    ((failure_count++))
                fi
            fi
        done
    fi
    
    echo "=== Bulk Deletion Summary ==="
    echo "Total files processed: $total_count"
    echo "Successful deletions: $success_count"
    echo "Failed deletions: $failure_count"
    
    log_action "Bulk deletion completed: $success_count/$total_count successful"
    audit_log "BULK_DELETE" "MULTIPLE" "COMPLETED" "Success: $success_count Failed: $failure_count Total: $total_count"
}

# Cleanup old backups based on retention policy
cleanup_old_backups() {
    echo "=== Backup Retention Cleanup ==="
    
    if [[ ! -d "$BACKUP_DIR" ]]; then
        echo "No backup directory found"
        return 0
    fi
    
    local retention_days="${BACKUP_RETENTION_DAYS:-30}"
    local cleanup_count=0
    
    # Find and remove old backups
    while IFS= read -r old_backup; do
        if [[ -n "$old_backup" ]]; then
            rm -f "$old_backup"
            ((cleanup_count++))
            echo "Removed old backup: $old_backup"
        fi
    done < <(find "$BACKUP_DIR" -type f -mtime +$retention_days 2>/dev/null)
    
    echo "Cleaned up $cleanup_count old backups (older than $retention_days days)"
    log_action "Backup cleanup: $cleanup_count old backups removed"
}

# Check system resources before deletion
check_system_resources() {
    echo "=== System Resource Check ==="
    
    # Check available disk space
    local available_space
    available_space=$(df -h / | tail -1 | awk '{print $4}' | sed 's/G//')
    
    echo "Available Space: ${available_space}GB"
    
    if [[ "$FREE_SPACE_MONITORING" == "true" ]] && (( $(echo "$available_space < 5" | bc -l) )); then
        echo "⚠️  Low disk space warning: ${available_space}GB available"
        log_action "Low disk space during deletion operation: ${available_space}GB"
    fi
    
    # Check system load
    local load_average
    load_average=$(uptime | awk -F'load average:' '{print $2}' | awk '{print $1}' | tr -d ',')
    
    echo "System Load: $load_average"
    
    if [[ "$SYSTEM_LOAD_MONITORING" == "true" ]] && (( $(echo "$load_average > 5.0" | bc -l) )); then
        echo "⚠️  High system load: $load_average"
        log_action "High system load during deletion operation: $load_average"
    fi
}

# Generate file deletion report
generate_deletion_report() {
    local report_file="/Library/Roundfleet/Reports/file_deletion_report_$(date +%Y%m%d_%H%M%S).json"
    
    echo "=== Generating File Deletion Report ==="
    
    mkdir -p "$(dirname "$report_file")"
    
    # Count recent operations from audit log
    local recent_deletions=0
    local successful_deletions=0
    local failed_deletions=0
    local total_backup_size=0
    
    if [[ -f "$AUDIT_LOG" ]]; then
        recent_deletions=$(grep -c "ACTION:SECURE_DELETE\|ACTION:BULK_DELETE" "$AUDIT_LOG" 2>/dev/null || echo 0)
        successful_deletions=$(grep -c "RESULT:SUCCESS" "$AUDIT_LOG" 2>/dev/null || echo 0)
        failed_deletions=$(grep -c "RESULT:FAILED" "$AUDIT_LOG" 2>/dev/null || echo 0)
    fi
    
    if [[ -d "$BACKUP_DIR" ]]; then
        total_backup_size=$(du -sh "$BACKUP_DIR" 2>/dev/null | awk '{print $1}' || echo "0")
    fi
    
    cat > "$report_file" << EOF
{
  "report_type": "file_deletion_management",
  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "device_info": {
    "hostname": "$(hostname)",
    "os_version": "$(sw_vers -productVersion)",
    "available_space": "$(df -h / | tail -1 | awk '{print $4}')"
  },
  "deletion_statistics": {
    "recent_deletions": $recent_deletions,
    "successful_deletions": $successful_deletions,
    "failed_deletions": $failed_deletions,
    "success_rate": "$(echo "scale=2; $successful_deletions * 100 / ($successful_deletions + $failed_deletions + 1)" | bc)%"
  },
  "backup_statistics": {
    "total_backup_size": "$total_backup_size",
    "backup_retention_days": $BACKUP_RETENTION_DAYS,
    "encrypted_backups": $ENCRYPTED_BACKUPS
  },
  "policy_configuration": {
    "secure_deletion": $SECURE_DELETION_ENABLED,
    "automatic_backup": $AUTOMATIC_BACKUP_ENABLED,
    "business_hours_protection": $BUSINESS_HOURS_PROTECTION,
    "sensitive_data_detection": $SENSITIVE_DATA_DETECTION
  },
  "security_status": {
    "system_file_protection": $PREVENT_SYSTEM_FILE_DELETION,
    "protected_directories": $PROTECTED_DIRECTORIES_ENFORCEMENT,
    "audit_enabled": $AUDIT_ALL_DELETIONS
  }
}
EOF
    
    echo "File deletion report saved to: $report_file"
    log_action "Deletion report generated: $report_file"
}

# Main function with argument handling
main() {
    log_action "=== Roundfleet File Deletion Management Tool Started ==="
    
    case "${1:-help}" in
        "delete")
            enterprise_file_delete "$2" "$3" "$4" "$5"
            ;;
        "bulk")
            bulk_file_deletion "$2" "$3" "$4"
            ;;
        "cleanup-backups")
            cleanup_old_backups
            ;;
        "report")
            generate_deletion_report
            ;;
        *)
            echo "Roundfleet Enterprise File and Folder Deletion Management Tool"
            echo "Usage: $0 [command] [options]"
            echo ""
            echo "Commands:"
            echo "  delete [file_path] [force] [secure] [backup]  - Delete file with enterprise controls"
            echo "  bulk [list_file/pattern] [force] [secure]     - Bulk deletion from file list or pattern"
            echo "  cleanup-backups                              - Remove old backups per retention policy"
            echo "  report                                       - Generate deletion management report"
            echo ""
            echo "Options:"
            echo "  force    - true/false (bypass safety checks)"
            echo "  secure   - true/false (enable secure deletion)"
            echo "  backup   - true/false (create backup before deletion)"
            echo ""
            echo "Examples:"
            echo "  $0 delete \"/Users/user/temp.txt\"            - Safe delete with backup"
            echo "  $0 delete \"/tmp/folder\" true true false     - Force secure delete without backup"
            echo "  $0 bulk \"*.log\" false true                 - Bulk secure delete log files"
            echo "  $0 bulk file_list.txt true                   - Bulk force delete from list"
            echo "  $0 cleanup-backups                           - Clean old backups"
            ;;
    esac
    
    log_action "=== File deletion management operation completed ==="
}

# Execute main function
main "$@"