You are not logged in.
Hi
About 30 minute ago all my files (about 30Gb) inside "/home/username/Downloads" folder disappeared. WTF!!! Chromium and Firefox both was opened at that time. from test disk I can see the deleted Downloads folder deleted about 30 minute ago and now what should I do.
Is there any way that tells me why this shit heppened to me. what process should I blame on it.
I used debugfs and it doesn't show any delete log. I run check disk. all is fine except it said I have 1 large file (what is that?)
Is there any chance that I can get my files back as I do not do anything wrong like power outage or accidently delete or ....
and journalctl doesn't log anything around the time files was delete
Edit: I already recover my data, the remaining question is how can I find the process who did this
Thanks
Last edited by bijanbina (2017-05-26 02:58:49)
Offline
Please edit your topic title and remove the superfluous exclamation marks.
I am going to assume from your tone that you do not have backups. If you do, then the easiest thing to do is restore from them, but if not, the important thing to do is stop using the disk where the data was deleted from, otherwise you run the risk of overwriting it.
Please post the output from your filesystem check, as well as the command you used to run it.
Last edited by WorMzy (2017-05-25 13:15:03)
Sakura:-
Mobo: MSI MAG X570S TORPEDO MAX // Processor: AMD Ryzen 9 5950X @4.9GHz // GFX: AMD Radeon RX 5700 XT // RAM: 32GB (4x 8GB) Corsair DDR4 (@ 3000MHz) // Storage: 1x 3TB HDD, 6x 1TB SSD, 2x 120GB SSD, 1x 275GB M2 SSD
Making lemonade from lemons since 2015.
Offline
Immediately unmount the partition with the "~/Downloads" directory, and check it using photorec. People (including me) have had good experience recovering videos, pictures, and music that way.
It is totally unacceptable for files to randomly be deleted! I'm sorry, I don't know how it could have happened. But I know I want to double check my backups when I get home today...
Good luck!
Offline
pacman -Qi bleachbit
?
Testdisk is btw. capable of restoring files.
https://wiki.archlinux.org/index.php/File_recovery
And there're still far too many exclamation marks - from *vast* experience: any action you take in panic mode will make things worse.
If you btw. can, you should dd the entire disk to another medium, so if you fuck up things, you got a backup.
Online
Thanks for all of your kind reply and sorry me for the delay.
Fortunately I could recover 80% of my data and lost about 20% of them due to my stupidity.
I wrap up all help I get here and eventually edit the first post to make it helpful for next unlucky person.
The data isn't very important to me (It's download folder right?) so I didn't create image with dd (strongly not recommended)
so
WHAT YOU SHOULDNT DO (but I do)
1. As suggested the most important tip is DONT PANIC. In my case I got angry, started to do some STFG and do anything anyone suggested without any thought. If this happened to you suspend is the best choice until you get calm.
2. Do not reboot your computer the way you normally do. In the normal halt process and boot up many read/write could damage lost data. I think kill -9 1 will be a good starting point to switch to some recovery live disk. (Hope for better suggestion for this part)
3. photorec is not just for photo recovery!!!. this is where I slack off. why they called it photo? and why all peaple on the net say that they used it only for photo?
In my case I had many lost pdf and I care for them. and the answer is photorec can almost recover any file (Of course If you have some luck with you) so be cheerful
4. If this happened without any power outage or some bugs eating SATA cable o-O then you can be pretty sure that this is not a HDD or filesystem fault. so both fsck and checkdisk won't help you. Just focus on recover files Inode
5. and the last tip which caused me to loss 20% of my data is don't fucking recover your data on your same partition. Could you believe that I really do it?
I ran photorec. select the disk and then select to write recover files in the same folder that I lost them. Shitt.... As soon as it started, It damage lost data so severely.... And it took me few seconds untils I realized what I had done. So think twice, do one.
--------------------------
But as I mentioned the deleted data isn't too much important for me. Instead I'm very keen to find process who did this to me so I could **** it ASAP.
Thank you and I'm waiting for any comment on that
Last edited by bijanbina (2017-05-26 02:35:37)
Offline
Please edit your topic title and remove the superfluous exclamation marks.
Then mark it solved.
Offline
WorMzy wrote:Please edit your topic title and remove the superfluous exclamation marks.
Then mark it solved.
mmm. This thread isn't ask how to recover lost data, rather it ask for how to find process that to the deletation process.
Thanks for your comment and I edit my post so it better express my question
Again Thank you.
Offline
Well that would be a bit difficult I would think. I'm almost sure that Linux doesn't keep a log of what files are deleted and how.
However if they 'were' deleted through the terminal with rm or some other command, then I suppose that the history of commands run would be in the bash log and you could see it there.
cat ~/.bash_history
I suppose you could also grep it to look for one of the file names of a file that was deleted like cat ~/.bash_history | grep "deletedfile.ext" and then you would see how/when they were deleted. (Or if an entire directory was deleted you could search for the directory and see if it was recursively deleted)
If they were deleted using the desktop environment or some other graphical interface, then I don't think that would leave a log.
Last edited by Zeox101 (2017-05-26 04:32:58)
The Hidden Secret of Arch Linux Forums:
No. No one here really uses archlinux. Arch Sucks.
We're just a bunch of neckbeards who tinker with arch linux in our mom's basement during our free time ... which we have a lot of because we are unemployed. ~ Trilby
Offline
If you didn't delete the data yourself (indeed lookup your shell history) my bets go on a "auto-cleanup" tool, bleachbit being the most prominent one. Those tools are no aides but a formidable way to shoot your own foot.
Data removal cause isn't logged by default, so you cannot lookup what caused this in the past.
If this thread is actually a sneaky ;-) way to ask "how can I log data manipulation", see https://wiki.archlinux.org/index.php/Audit_framework and https://superuser.com/questions/968550/ … out-unlink
Online
Or some GUI file manager moved them en masse somewhere, or perhaps deleted them. I'm thinking a Ctrl-a followed by a backspace could have disastrous results in your run of the mill file manager.
Or a badly behaved build script.
Or a typo in an rm command that used globs
Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way
Offline
Firefox will clear your downloads is you have that privacy option enabled in addition to cookie, history, logins, passwords, etc.
Offline
Firefox will clear your downloads is you have that privacy option enabled in addition to cookie, history, logins, passwords, etc.
Wait, what??? Are you suggesting that Firefox will DELETE files?
I don't think that's the case... But there IS an option to delete the RECORD of downloaded files that Firefox keeps...
Offline