I am seeking data recovery/rescue advice—and it's not a typical situation

JMacSmith · 06-13-2017, 10:16 PM

I backed up my "Home" folder on an external hard drive and re-installed Linux (long story, but it was necessary). Instead of copy and pasting from the external hard drive, I cut and pasted the Home folder. Now, I had fully intended to copy and paste. It was an accident. Then later, I decided to reinstall Linux a second time (again, long story, but it was necessary) and I went back to my trusty external hard drive and discovered no Home folder. It was only then that I realized I cut and pasted instead of copy and pasted.

My question this (and you probably can see it coming): can I rescue the home folder from the external hard drive? If so, how?

Is it still 'there' on the hard drive, but not viewable with the OS? Sort of like if you went to a library and threw away the cards from the card catalog of a certain book. The book would still be there; it would just be more difficult to find. It seems to me that if it was 'there' at some point, it will be 'there' until that sector of the drive is written over by something else. Is that how it works? If so, can I somehow find these files?

Thank you

Here's my computer's information:

Code:

mac@mac-Lenovo-Y50-70-Touch ~ $ inxi -Fxzd
System:    Host: mac-Lenovo-Y50-70-Touch Kernel: 4.4.0-79-generic x86_64 (64 bit gcc: 5.4.0)
           Desktop: Cinnamon 3.2.7 (Gtk 3.18.9-1ubuntu3.3)
           Distro: Linux Mint 18.1 Serena
Machine:   System: LENOVO product: 20349 v: Lenovo Y50-70 Touch
           Mobo: LENOVO model: Lenovo Y50-70 Touch v: 31900058Std
           Bios: LENOVO v: 9ECN43WW(V3.03) date: 08/12/2015
CPU:       Quad core Intel Core i7-4700HQ (-HT-MCP-) cache: 6144 KB
           flags: (lm nx sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx) bmips: 19153
           clock speeds: max: 3400 MHz 1: 2400 MHz 2: 2444 MHz 3: 2398 MHz
           4: 2418 MHz 5: 2395 MHz 6: 2424 MHz 7: 2394 MHz 8: 2416 MHz
Graphics:  Card-1: Intel 4th Gen Core Processor Integrated Graphics Controller
           bus-ID: 00:02.0
           Card-2: NVIDIA GM107M [GeForce GTX 860M] bus-ID: 01:00.0
           Display Server: X.Org 1.18.4 drivers: intel (unloaded: fbdev,vesa) FAILED: nouveau
           Resolution: 3200x1800@48.00hz
           GLX Renderer: N/A GLX Version: N/A Direct Rendering: N/A
Audio:     Card-1 Intel 8 Series/C220 Series High Definition Audio Controller
           driver: snd_hda_intel bus-ID: 00:1b.0
           Card-2 Intel Xeon E3-1200 v3/4th Gen Core Processor HD Audio Controller
           driver: snd_hda_intel bus-ID: 00:03.0
           Sound: Advanced Linux Sound Architecture v: k4.4.0-79-generic
Network:   Card-1: Intel Wireless 7260 driver: iwlwifi bus-ID: 08:00.0
           IF: wlp8s0 state: up mac: <filter>
           Card-2: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller
           driver: r8169 v: 2.3LK-NAPI port: 3000 bus-ID: 09:00.0
           IF: enp9s0 state: up speed: 100 Mbps duplex: full mac: <filter>
           Card-3: Atmel usb-ID: 003-002
           IF: null-if-id state: N/A speed: N/A duplex: N/A mac: N/A
Drives:    HDD Total Size: 2000.4GB (44.5% used)
           ID-1: /dev/sda model: Crucial_CT1024MX size: 1000.2GB
           ID-2: /dev/mmcblk0 model: N/A size: 63.9GB
           ID-3: USB /dev/sdb model: TOURO_S size: 1000.2GB
           Optical: No optical drives detected.
Partition: ID-1: / size: 902G used: 7.6G (1%) fs: ext4 dev: /dev/sda1
           ID-2: swap-1 size: 17.09GB used: 0.00GB (0%) fs: swap dev: /dev/sda5
RAID:      No RAID devices: /proc/mdstat, md_mod kernel module present
Sensors:   System Temperatures: cpu: 54.0C mobo: N/A
           Fan Speeds (in rpm): cpu: N/A
Info:      Processes: 278 Uptime: 7:55 Memory: 4031.0/15963.7MB
           Init: systemd runlevel: 5 Gcc sys: 5.4.0
           Client: Shell (bash 4.3.481) inxi: 2.2.35

AwesomeMachine · 06-13-2017, 10:22 PM

Well, your situation IS typical. And, yes, the files are still there. What file system are you using?

frankbell · 06-13-2017, 10:27 PM

With the external drive connected and mounted, what is the output of

Code:

fdisk -l

You may have to run that command as root.

If the command returns that the file system is NTFS, do you have ntfs3g installed.

Also, what distro/version are you using? Your user agent reports Ubuntu, but many Ubuntu derivatives report as Ubuntu.

JMacSmith · 06-13-2017, 10:28 PM

Quote:

Originally Posted by AwesomeMachine

Well, your situation IS typical. And, yes, the files are still there. What file system are you using?

Ok, I'm glad to learn that my situation is typical. I thought the typical situation is "oops, I accidentally pressed 'delete'" or a case that the hard drive itself had a problem.

Here's my computer's info...

Code:

mac@mac-Lenovo-Y50-70-Touch ~ $ inxi -Fxzd
System:    Host: mac-Lenovo-Y50-70-Touch Kernel: 4.4.0-79-generic x86_64 (64 bit gcc: 5.4.0)
           Desktop: Cinnamon 3.2.7 (Gtk 3.18.9-1ubuntu3.3)
           Distro: Linux Mint 18.1 Serena
Machine:   System: LENOVO product: 20349 v: Lenovo Y50-70 Touch
           Mobo: LENOVO model: Lenovo Y50-70 Touch v: 31900058Std
           Bios: LENOVO v: 9ECN43WW(V3.03) date: 08/12/2015
CPU:       Quad core Intel Core i7-4700HQ (-HT-MCP-) cache: 6144 KB
           flags: (lm nx sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx) bmips: 19153
           clock speeds: max: 3400 MHz 1: 2400 MHz 2: 2444 MHz 3: 2398 MHz
           4: 2418 MHz 5: 2395 MHz 6: 2424 MHz 7: 2394 MHz 8: 2416 MHz
Graphics:  Card-1: Intel 4th Gen Core Processor Integrated Graphics Controller
           bus-ID: 00:02.0
           Card-2: NVIDIA GM107M [GeForce GTX 860M] bus-ID: 01:00.0
           Display Server: X.Org 1.18.4 drivers: intel (unloaded: fbdev,vesa) FAILED: nouveau
           Resolution: 3200x1800@48.00hz
           GLX Renderer: N/A GLX Version: N/A Direct Rendering: N/A
Audio:     Card-1 Intel 8 Series/C220 Series High Definition Audio Controller
           driver: snd_hda_intel bus-ID: 00:1b.0
           Card-2 Intel Xeon E3-1200 v3/4th Gen Core Processor HD Audio Controller
           driver: snd_hda_intel bus-ID: 00:03.0
           Sound: Advanced Linux Sound Architecture v: k4.4.0-79-generic
Network:   Card-1: Intel Wireless 7260 driver: iwlwifi bus-ID: 08:00.0
           IF: wlp8s0 state: up mac: <filter>
           Card-2: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller
           driver: r8169 v: 2.3LK-NAPI port: 3000 bus-ID: 09:00.0
           IF: enp9s0 state: up speed: 100 Mbps duplex: full mac: <filter>
           Card-3: Atmel usb-ID: 003-002
           IF: null-if-id state: N/A speed: N/A duplex: N/A mac: N/A
Drives:    HDD Total Size: 2000.4GB (44.5% used)
           ID-1: /dev/sda model: Crucial_CT1024MX size: 1000.2GB
           ID-2: /dev/mmcblk0 model: N/A size: 63.9GB
           ID-3: USB /dev/sdb model: TOURO_S size: 1000.2GB
           Optical: No optical drives detected.
Partition: ID-1: / size: 902G used: 7.6G (1%) fs: ext4 dev: /dev/sda1
           ID-2: swap-1 size: 17.09GB used: 0.00GB (0%) fs: swap dev: /dev/sda5
RAID:      No RAID devices: /proc/mdstat, md_mod kernel module present
Sensors:   System Temperatures: cpu: 54.0C mobo: N/A
           Fan Speeds (in rpm): cpu: N/A
Info:      Processes: 278 Uptime: 7:55 Memory: 4031.0/15963.7MB
           Init: systemd runlevel: 5 Gcc sys: 5.4.0
           Client: Shell (bash 4.3.481) inxi: 2.2.35

I'm a bit of a dummy when it comes to this stuff (but I'm learning). My file system is Nemo.

AwesomeMachine · 06-15-2017, 07:56 PM

Please try the "fdisk -l" command according frankbell's instructions.

jefro · 06-15-2017, 09:55 PM

I think I'd be trying a program called testdisk before you make too many changes to the external drive. Photorec is similar but many live cd's have testdisk or you can easily add it in.

dave@burn-it.co.uk · 06-16-2017, 09:38 AM

Photorec and testdisk are the same thing. Sometimes it is called just by one of the names, but usually people use both with a slash between the names.

jefro · 06-16-2017, 03:05 PM

"Data recovery
If you have lost partition or strange problem with your hard disk partitions, run TestDisk to recover your data. TestDisk detects numerous filesystem including NTFS, FAT12, FAT16, FAT32, exFAT, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS.

TestDisk can also undelete files from FAT, NTFS, exFAT and ext2 filesystem.

To recover your lost digital pictures or lost files, try PhotoRec. PhotoRec is a signature based file recovery utility. It handles more than 440 file formats including JPG, MSOffice, OpenOffice documents. "

http://www.cgsecurity.org/

Not the same. Different OS programs are separate instead of a command line option.

AwesomeMachine · 06-19-2017, 09:45 PM

I might try foremost.

JMacSmith · 06-22-2017, 02:53 AM

The good news: I recovered everything I wanted to recover with Photorec.

The bad news: Photorec recovered about 50,000 different files that I didn't want to recover.

That wouldn't be so bad, except that, as you know, Photorec grabs the files off the disc and gives them seemingly arbitrary names (the meta-data having been deleted). So now I have the fun task of going through tens of thousands of files, deleting the ones I don't want, and renaming and refiling the ones I do want.

Well, there goes my summer vacation.

syg00 · 06-22-2017, 03:32 AM

Standard practice in such a case - a quick search should find scripts that will recover, er reclaim, most of your vacation time. Generally just something grep or exiftool if you know what you are searching for - should even be some on the gcsecurity site.