#1 2018-05-13 04:16:28

joes

Member

Registered: 2017-08-07

Posts: 20

Recovery of hard drive information [Solved]

I installed bunsenlabs Helium today. Problem is I lost all my information on my backup hard drive. I don't know how this happened, I only used the primary hard drive. Is there any way to recover this?

Appreciate any help

Joe

Last edited by joes (2018-05-14 05:30:44)

ohnonot

...again

Registered: 2015-09-29

Posts: 5,592

Re: Recovery of hard drive information [Solved]

depends on how you lost it, how it is/was partitioned, and what filesystem(s) it contained.

the very first thing is to not mount the hard drive anymore.
the very second thing is to copy everything you recover to a separate drive.
It's also highly recommended to work on a copy of the complete drive, i.e. ideally you would have plenty of space on another drive, and 'dd if=/dev/sdX of=image-of-sdX' the complete drive, then mount the image (read-only) and work on that. depends a little on the tools you sue to recover.

btw, most things you do from now on are with superuser privileges.

if you can still access the partitions and their filesystems:
if the filesystem is ext2/3/4, i would proceed with extundelete
if the filesystem is NTFS (Windows) you might want to use some windows tools.
if that does not recover enough, you need to use testdisk/photorec, which is tricky and requires reading documentation beforehand.

Last edited by ohnonot (2018-05-13 05:22:34)

joes

Member

Registered: 2017-08-07

Posts: 20

Re: Recovery of hard drive information [Solved]

depends on how you lost it, how it is/was partitioned, and what filesystem(s) it contained.

I'm not sure how I lost it. I have partitions sda2 as /, sda3 as /home and sda4 as swap. I used these 3 and reformatted sda2 and sda3. I was going to copy the files from my backup hard drive (sdb1) to sda3, but all I found was empty folders. There is one partition on the backup drive, ext4.

the very first thing is to not mount the hard drive anymore.
the very second thing is to copy everything you recover to a separate drive.
It's also highly recommended to work on a copy of the complete drive, i.e. ideally you would have plenty of space on another drive, and 'dd if=/dev/sdX of=image-of-sdX' the complete drive, then mount the image (read-only) and work on that. depends a little on the tools you sue to recover.

Can I dd to my home directory on sda3 or need to get another drive?
Can I use uxtundelete without mounting the partition?

ohnonot

...again

Registered: 2015-09-29

Posts: 5,592

Re: Recovery of hard drive information [Solved]

maybe i jumped the gun a little; i'm now not at all sure that you really have lost data.
please post the output of

uname -rv
sudo fdisk -l
mount

don't do anything else yet.
and you are missing files from sdb's partitions? sda is all good?

joes

Member

Registered: 2017-08-07

Posts: 20

Re: Recovery of hard drive information [Solved]

maybe i jumped the gun a little; i'm now not at all sure that you really have lost data.
please post the output of

uname -rv
sudo fdisk -l
mount

don't do anything else yet.
and you are missing files from sdb's partitions? sda is all good?

joe@Bunsenlabs:~$ uname -rv
4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07)

joe@Bunsenlabs:~$ sudo fdisk -l
[sudo] password for joe: 
Disk /dev/sda: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x6943a740

Device     Boot      Start        End    Sectors   Size Id Type
/dev/sda1  *          2048   58593279   58591232    28G  7 HPFS/NTFS/exFAT
/dev/sda2         58593280  136718335   78125056  37.3G 83 Linux
/dev/sda3        136718336 1941405695 1804687360 860.6G 83 Linux
/dev/sda4       1941405696 1953523711   12118016   5.8G 82 Linux swap / Solaris




Disk /dev/sdb: 931.5 GiB, 1000170586112 bytes, 1953458176 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xe5751eff

Device     Boot Start        End    Sectors   Size Id Type
/dev/sdb1        2048 1953458175 1953456128 931.5G 83 Linux

joe@Bunsenlabs:~$ mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,nosuid,relatime,size=4009748k,nr_inodes=1002437,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=805048k,mode=755)
/dev/sda2 on / type ext4 (rw,relatime,errors=remount-ro,data=ordered)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=35,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=830)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
mqueue on /dev/mqueue type mqueue (rw,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime)
/dev/sda3 on /home type ext4 (rw,relatime,data=ordered)
tmpfs on /run/user/109 type tmpfs (rw,nosuid,nodev,relatime,size=805044k,mode=700,uid=109,gid=116)
fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)
gvfsd-fuse on /run/user/109/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=109,group_id=116)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=805044k,mode=700,uid=1000,gid=1000)
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)

and you are missing files from sdb's partitions? sda is all good?

Yes, that's right.

Last edited by joes (2018-05-13 16:00:16)

ohnonot

...again

Registered: 2015-09-29

Posts: 5,592

Re: Recovery of hard drive information [Solved]

was sdb1 mounted when you posted the 'mount' output?
can't see it.
i'm not sure if gvfs did some magic there (but i wouldn't see why when it contains a Linux filesystem), so please tell us, or repeat the 'mount' command when you are sure sdb1 is mounted.

did you put an entry in /etc/fstab regarding sdb1?
what sort of drive is it? normal hd with usb enclosure (that's what they usually sell as backup drives)?

if it was indeed gvfs mounting the drive, you could try unmounting it, then mounting it the good old way:

# magical gvfs or fusermount commands to unmount first
mkdir mnt
sudo mount /dev/sdb1 mnt
cd mnt
ls -al

joes

Member

Registered: 2017-08-07

Posts: 20

Re: Recovery of hard drive information [Solved]

This is strange. Yesterday I mounted /dev/sdb1: mount -t ext4 /dev/sdb1 /mnt/rbackup and all I saw was empty folders. Now I mounted it with sudo mount /dev/sdb1 /mnt/rbackup and I found the files. Don't know what happened since then.

joe@Bunsenlabs:/mnt/rbackup$ ls -al
total 72
drwxr-xr-x 18 root root 4096 May 12 19:10 .
drwxr-xr-x  3 root root 4096 May 12 20:45 ..
drwxr-xr-x  7 root root 4096 Apr 30 10:05 backup.00
drwxr-xr-x  7 root root 4096 Apr 30 10:05 backup.01
drwxr-xr-x  7 root root 4096 Apr 30 10:05 backup.02
drwxr-xr-x  7 root root 4096 Apr 30 10:05 backup.03
drwxr-xr-x  7 root root 4096 Apr 30 10:05 backup.04
drwxr-xr-x  7 root root 4096 Mar 29 13:18 backup.05
drwxr-xr-x  7 root root 4096 Mar 29 13:18 backup.06
drwxr-xr-x  7 root root 4096 Mar 29 13:18 backup.07
drwxr-xr-x  7 root root 4096 Mar 29 13:18 backup.08
drwxr-xr-x  7 root root 4096 Mar 31 19:32 backup.09
drwxr-xr-x  7 root root 4096 Feb 20 18:19 backup.10
drwxr-xr-x  7 root root 4096 Mar 17 10:38 backup.11
drwxr-xr-x  7 root root 4096 Feb 20 18:19 backup.12
drwxr-xr-x  7 root root 4096 Feb 20 18:19 backup.13
drwxr-xr-x  7 root root 4096 Feb 20 18:19 backup.14
drwxr-xr-x  7 root root 4096 Jan 13 10:03 backup.15

Do you know what would cause that?
Do you know how to copy the files back to /home/joe/ without the hidden files. I would like to just copy the ones I edited?

Joe

ohnonot

...again

Registered: 2015-09-29

Posts: 5,592

Re: Recovery of hard drive information [Solved]

thank god i pulled the brakes.
please mark the thread [SOLVED] by editing the first post.
thanks.