You are not logged in.

#1 2017-05-25 10:42:49

bijanbina
Member
From: Tehran
Registered: 2014-07-13
Posts: 20
Website

All Files inside Download folder disappeared (Who did that?)

Hi
About 30 minute ago all my files (about 30Gb)  inside "/home/username/Downloads" folder disappeared. WTF!!! Chromium and Firefox both was opened at that time. from test disk I can see the deleted Downloads folder deleted about 30 minute ago and now what should I do.
Is there any way that tells me why this shit heppened to me. what process should I blame on it.

I used debugfs and it doesn't show any delete log. I run check disk. all is fine except it said I have 1 large file (what is that?)
Is there any chance that I can get my files back as I do not do anything wrong like power outage or accidently delete or ....

and journalctl doesn't log anything around the time files was delete

Edit: I already recover my data, the remaining question is how can I find the process who did this

Thanks

Last edited by bijanbina (2017-05-26 02:58:49)

Offline

#2 2017-05-25 12:39:31

WorMzy
Forum Moderator
From: Scotland
Registered: 2010-06-16
Posts: 11,787
Website

Re: All Files inside Download folder disappeared (Who did that?)

Please edit your topic title and remove the superfluous exclamation marks.

I am going to assume from your tone that you do not have backups. If you do, then the easiest thing to do is restore from them, but if not, the important thing to do is stop using the disk where the data was deleted from, otherwise you run the risk of overwriting it.

Please post the output from your filesystem check, as well as the command you used to run it.

Last edited by WorMzy (2017-05-25 13:15:03)


Sakura:-
Mobo: MSI MAG X570S TORPEDO MAX // Processor: AMD Ryzen 9 5950X @4.9GHz // GFX: AMD Radeon RX 5700 XT // RAM: 32GB (4x 8GB) Corsair DDR4 (@ 3000MHz) // Storage: 1x 3TB HDD, 6x 1TB SSD, 2x 120GB SSD, 1x 275GB M2 SSD

Making lemonade from lemons since 2015.

Offline

#3 2017-05-25 12:41:41

drcouzelis
Member
From: Connecticut, USA
Registered: 2009-11-09
Posts: 4,092
Website

Re: All Files inside Download folder disappeared (Who did that?)

Immediately unmount the partition with the "~/Downloads" directory, and check it using photorec. People (including me) have had good experience recovering videos, pictures, and music that way.

It is totally unacceptable for files to randomly be deleted! I'm sorry, I don't know how it could have happened. But I know I want to double check my backups when I get home today... hmm

Good luck!

Offline

#4 2017-05-25 12:53:24

seth
Member
Registered: 2012-09-03
Posts: 49,992

Re: All Files inside Download folder disappeared (Who did that?)

pacman -Qi bleachbit

?

Testdisk is btw. capable of restoring files.
https://wiki.archlinux.org/index.php/File_recovery

And there're still far too many exclamation marks - from *vast* experience: any action you take in panic mode will make things worse.
If you btw. can, you should dd the entire disk to another medium, so if you fuck up things, you got a backup.

Offline

#5 2017-05-26 02:30:03

bijanbina
Member
From: Tehran
Registered: 2014-07-13
Posts: 20
Website

Re: All Files inside Download folder disappeared (Who did that?)

Thanks for all of your kind reply and sorry me for the delay.

Fortunately I could recover 80% of my data and lost about 20% of them due to my stupidity.
I wrap up all help I get here and eventually edit the first post to make it helpful for next unlucky person.

The data isn't very important to me (It's download folder right?) so I didn't create image with dd (strongly not recommended)
so

WHAT YOU SHOULDNT DO (but I do)
1. As suggested the most important tip is DONT PANIC. In my case I got angry, started to do some STFG and do anything anyone suggested without any thought. If this happened to you suspend is the best choice until you get calm.
2. Do not reboot your computer the way you normally do. In the normal halt process and boot up many read/write could damage lost data. I think kill -9 1 will be a good starting point to switch to some recovery live disk. (Hope for better suggestion for this part)
3. photorec is not just for photo recovery!!!. this is where I slack off. why they called it photo? and why all peaple on the net say that they used it only for photo?
In my case I had many lost pdf and I care for them. and the answer is photorec can almost recover any file (Of course If you have some luck with you) so be cheerful
4. If this happened without any power outage or some bugs eating SATA cable o-O then you can be pretty sure that this is not a HDD or filesystem fault. so both fsck and checkdisk won't help you. Just focus on recover files Inode
5. and the last tip which caused me to loss 20% of my data is don't fucking recover your data on your same partition. Could you believe that I really do it?
I ran photorec. select the disk and then select to write recover files in the same folder that I lost them. Shitt....  As soon as it started, It damage lost data so severely.... And it took me few seconds untils I realized what I had done. So think twice, do one.

--------------------------

But as I mentioned the deleted data isn't too much important for me. Instead I'm very keen to find process who did this to me so I could **** it ASAP.
Thank you and I'm waiting for any comment on that

Last edited by bijanbina (2017-05-26 02:35:37)

Offline

#6 2017-05-26 02:39:50

jasonwryan
Anarchist
From: .nz
Registered: 2009-05-09
Posts: 30,424
Website

Re: All Files inside Download folder disappeared (Who did that?)

WorMzy wrote:

Please edit your topic title and remove the superfluous exclamation marks.

Then mark it solved.


Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

Offline

#7 2017-05-26 02:57:13

bijanbina
Member
From: Tehran
Registered: 2014-07-13
Posts: 20
Website

Re: All Files inside Download folder disappeared (Who did that?)

jasonwryan wrote:
WorMzy wrote:

Please edit your topic title and remove the superfluous exclamation marks.

Then mark it solved.

mmm. This thread isn't ask how to recover lost data, rather it ask for how to find process that to the deletation process.
Thanks for your comment and I edit my post so it better express my question

Again Thank you.

Offline

#8 2017-05-26 04:31:23

Zeox101
Member
Registered: 2017-02-05
Posts: 93

Re: All Files inside Download folder disappeared (Who did that?)

Well that would be a bit difficult I would think. I'm almost sure that Linux doesn't keep a log of what files are deleted and how.

However if they 'were' deleted through the terminal with rm or some other command, then I suppose that the history of commands run would be in the bash log and you could see it there.

cat ~/.bash_history

I suppose you could also grep it to look for one of the file names of a file that was deleted like cat ~/.bash_history | grep "deletedfile.ext" and then you would see how/when they were deleted. (Or if an entire directory was deleted you could search for the directory and see if it was recursively deleted)

If they were deleted using the desktop environment or some other graphical interface, then I don't think that would leave a log.

Last edited by Zeox101 (2017-05-26 04:32:58)


The Hidden Secret of Arch Linux Forums:
No.  No one here really uses archlinux.  Arch Sucks.
We're just a bunch of neckbeards who tinker with arch linux in our mom's basement during our free time ... which we have a lot of because we are unemployed. ~ Trilby

Offline

#9 2017-05-26 05:30:41

seth
Member
Registered: 2012-09-03
Posts: 49,992

Re: All Files inside Download folder disappeared (Who did that?)

If you didn't delete the data yourself (indeed lookup your shell history) my bets go on a "auto-cleanup" tool, bleachbit being the most prominent one. Those tools are no aides but a formidable way to shoot your own foot.

Data removal cause isn't logged by default, so you cannot lookup what caused this in the past.
If this thread is actually a sneaky ;-) way to ask "how can I log data manipulation", see https://wiki.archlinux.org/index.php/Audit_framework and https://superuser.com/questions/968550/ … out-unlink

Offline

#10 2017-05-26 06:07:19

ewaller
Administrator
From: Pasadena, CA
Registered: 2009-07-13
Posts: 19,740

Re: All Files inside Download folder disappeared (Who did that?)

Or some GUI file manager moved them en masse somewhere, or perhaps deleted them.  I'm thinking a Ctrl-a followed by a backspace could have disastrous results in your run of the mill file manager.
Or a badly behaved build script.
Or a typo in an rm command that used globs


Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way

Offline

#11 2017-05-26 12:40:51

KairiTech
Member
From: Toronto, Canada
Registered: 2011-06-04
Posts: 275

Re: All Files inside Download folder disappeared (Who did that?)

Firefox will clear your downloads is you have that privacy option enabled in addition to cookie, history, logins, passwords, etc.

Offline

#12 2017-05-26 13:08:55

drcouzelis
Member
From: Connecticut, USA
Registered: 2009-11-09
Posts: 4,092
Website

Re: All Files inside Download folder disappeared (Who did that?)

KairiTech wrote:

Firefox will clear your downloads is you have that privacy option enabled in addition to cookie, history, logins, passwords, etc.

Wait, what??? Are you suggesting that Firefox will DELETE files?

I don't think that's the case... But there IS an option to delete the RECORD of downloaded files that Firefox keeps...

Offline

Board footer

Powered by FluxBB