HELP!! Files seem to have unpackaged/moved themselves over-night?! Need help ASAP, will pay reward if problem solved!!
Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
HELP!! Files seem to have unpackaged/moved themselves over-night?! Need help ASAP, will pay reward if problem solved!!
Hello everyone and thanks for taking the time to read this! I'm quite a noob with Linux and computers in general (but am trying to get better). I hope I get my problem across well enough & that Ive posted this in the right forum. Anyway, my problem is as such..
Been getting into crypto recently, been investing in a bunch of coins and over the last couple of weeks have been moving everything onto hardware wallets & cold storage to sit on for a while. Two days ago I was buying the last 2 crypto assets that I wanted in my portfolio - SHIP & TOMO
For those unfamiliar, both tokens are only available atm on a pretty small, illiquid exchange called IDEX. I didnt have an account with IDEX before (because too small & illiquid) but decided to get one specifically for these 2 assets.
Fast forwarding a little bit to get into the problem a bit quicker, to access your IDEX account (in the way I set it up with Keystore File) you have to open it with a JSON.file(which you download from them) + your password.
I do all this and everything is fine, the file automatically saves itself in 'Computer > tmp > mozilla_mark > UTC_..' (UTC.. being the file in question that unlocks they account). So I log on, place my orders and log off, thinking I will come back in 1-2 days to see if my orders have filled, and if so, move them onto respective hardware wallets.
2 days later is today and when I go to log in and find my 'UTC...' file, it has disappeared?!?! the folder only goes as far as 'Computer > tmp >' now, and in its place for the other folders/files, are completely random ones Ive never seen before, varying in size & nonsense.
I feel physically sick and am so scared, please if anyone can help me figure out:
A) why the files moved/changed themselves like this?
B) how can I reverse it?
C) how can I prevent it happening again?
I understand this may not be a specific Linux problem though IDK what else it could be, I've never had happen this before and am new to Linux since 2 weeks so hoping its just a easily fixed system fault!
Like I said above, really urgently need some help on this, its a very large amount of money (for me) at risk of being lost forever because of this stupid file and will happily pay any1 who manages to help a reward fee, payable in BTC/LTC/XMR or FIAT
If someone does read this and wants to try and help but I have missed out any info that might be useful please let me know and I will try and clarify a bit better!
thanks so much anyone who read
Mark
Last edited by NotNow; 03-28-2018 at 12:01 PM.
Reason: added attachment to show the new random files that replaced the missing one
/tmp is, as its name implies, a temporary directory. You should never rely on anything that is there staying there, especially after a reboot when many systems automatically delete the files in it.
/tmp is, as its name implies, a temporary directory. You should never rely on anything that is there staying there, especially after a reboot when many systems automatically delete the files in it.
OK, Now I know that I will be careful in the future. I have already contacted IDEX and am awaiting a reply, but I very much doubt they will be able to help with anything.
If everything in the 'tmp' file gets deleted, how come other programs that I had downloaded but not used were not altered or deleted in the same way?? There is nothing in the recycle bin either, is there any way to do a a window-esque style system restore to 2days ago?
Or surely there must be some way to retrieve the deleted file?? I find it hard to believe a laptop will permanently delete 1 specific file while leaving others, and then on top of that, making it all irreversable. especcially when there wasnt a large delayed timeframe too (
If you installed a program like TimeShift, or have made a system backup/image/snapshot then you can roll back. If not, no.
You could try the file undeleters TestDisk and Photorec to see what you can find, but in that case I would advise you to use your system at the bare minimum, to lessen the chance of the deleted files' data being over-written, or, even better, make a complete backup of your disk/partition and then work on that data offline.
I dont have any of the things you mentioned in your first line, no, and I don't know what you even said in the second one, I have only been using Linux 2 weeks and cannot stress enough how hopelessly retarded I am with technology, so when posting this in 'newbies' I would appreciate if you (or any future posters) could dumb-it-down as much as possible or just ELI5..
but unfortunately Im getting an increasing feeling of dread and that what your actually telling me is that its all completely gone and irreversible, correct?
I still dont understand WHY though? why was this specific file de-packaged, moved around & deleted, but others stayed exactly as they were, no changes?
the file automatically saves itself in 'Computer > tmp > mozilla_mark > UTC_..
That would be an unusual location for a download unless they had instructions telling you to move it after download?
First thing, stop using the computer. Timeshift is software which performs a function similar to the windows recovery where you can set a complete backup to a previous state. Never used it myself but that is my understanding. Doesn't help in your case as it is too late. Might be useful in the future .
The file/data is generally not deleted. An analogy would be to a book with an index, rather than deleting an entire chapter, it deletes the reference in the index. To get more detailed on how this works would require someone more knowledgeablt than myself.
Stop using the computer, the more you use it the less likely you will be able to recover anything. If you have a Live CD/usb, use that. There is a program called extundelete which is available from a download link at the site below which also includes documentation on its usage. Might be a little complicated for your knowledge?
What version of Ubuntu are you running? In recent versions, /tmp is a tmpfs kept in RAM, not on the disk, and disappears when the system is shut down or rebooted.
Open up a terminal window and type "df /tmp". If the filesystem type is "tmpfs", then the files you saved there were never written to persistent storage.
/tmp is, as its name implies, a temporary directory. You should never rely on anything that is there staying there, especially after a reboot when many systems automatically delete the files in it.
Quote:
Originally Posted by yancek
That would be an unusual location for a download unless they had instructions telling you to move it after download? I have only been using Linux 2 weeks, but so far all my downloads automatically go there, is that a problem?
First thing, stop using the computer. Timeshift is software which performs a function similar to the windows recovery where you can set a complete backup to a previous state. Never used it myself but that is my understanding. Doesn't help in your case as it is too late. Might be useful in the future .
The file/data is generally not deleted. An analogy would be to a book with an index, rather than deleting an entire chapter, it deletes the reference in the index. To get more detailed on how this works would require someone more knowledgeablt than myself. Useful analogy!
Stop using the computer, the more you use it the less likely you will be able to recover anything. If you have a Live CD/usb, use that. There is a program called extundelete which is available from a download link at the site below which also includes documentation on its usage. Might be a little complicated for your knowledge? IDK what you mean by Live cd/usb, probably a bit over my head but Ill have a look for sure and come back/let you know how I found it.
- currently trying these steps, very complicated for me so may take a while, but am exploring this & all options as best I can, Thanks for the response!
Last edited by NotNow; 03-28-2018 at 11:26 AM.
Reason: Replies are written directly after your sentences, my mistake!! it doesnt read very well
mark@mark-ThinkPad-T400:~$ df /tmp
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/ubuntu--vg-root 222088868 6116460 204667860 3% /
That's good! It means that /tmp is just a directory in your root filesystem. The data was stored on the disk, so there is an opportunity for recovery. But it is imperative that you stop using the system now. The next step should be to save an image of that root filesystem to external media, preferably two copies so that you can work on one without fear of accidentally damaging it.
That's good! It means that /tmp is just a directory in your root filesystem. The data was stored on the disk, so there is an opportunity for recovery. But it is imperative that you stop using the system now. The next step should be to save an image of that root filesystem to external media, preferably two copies so that you can work on one without fear of accidentally damaging it.
Ive attached a screenshot btw of the random files that replaced the missing 'UTC' file, I am open to the idea it might have been automatically deleted somehow, but that doest explain the random occurence of these now new files, is it possible they got mistakenly depackaged or split somehow and if so could there could be a reversal?
- didnt realise it would display the attachment itself, hope that didnt sound rude!
Last edited by NotNow; 03-28-2018 at 11:58 AM.
Reason: didnt want message to come accross rude
The standard location for downloading on most Linux systems (browsers) is the user Downloads directory. You can set that in your browser. Not sure which browser you are using but, if it is Firefox, you can click Edit then Preferences and scroll down to the section which allows you to select where to download. If you are using a different browser, you will certainly have that option but you'll have to look for it.
The image you posted of your /tmp directory looks standard. I have similar directories on the Ubuntu 16.04 I have installed. You see the lock icon because you are trying to access as a normal user so you need to do it as root. To open with root privileges from Ubuntu use gksu nautilus. If gksu is not installed, use sudo nautilus. The second method is discouraged by Ubuntu although I've never had a problem. You can then view the various directories and their contents.
You could use the dd command to create an image of the partition. I've never used LVM so am not sure how you would do that.
Another possibility is clonezilla, see the site below.
The standard location for downloading on most Linux systems (browsers) is the user Downloads directory. You can set that in your browser. Not sure which browser you are using but, if it is Firefox, you can click Edit then Preferences and scroll down to the section which allows you to select where to download. If you are using a different browser, you will certainly have that option but you'll have to look for it.
The image you posted of your /tmp directory looks standard. I have similar directories on the Ubuntu 16.04 I have installed. You see the lock icon because you are trying to access as a normal user so you need to do it as root. To open with root privileges from Ubuntu use gksu nautilus. If gksu is not installed, use sudo nautilus. The second method is discouraged by Ubuntu although I've never had a problem. You can then view the various directories and their contents.
You could use the dd command to create an image of the partition. I've never used LVM so am not sure how you would do that.
Another possibility is clonezilla, see the site below.
I just used gsku nautilus to look at them, they all just have empty tmp folders in them. But NONE of them were there before!! the only thing in that folder was the UTC key and 3 other items (which I deleted earlier today) the laptop had been off since then, so I still dont understand WHY this has happened, why this SPECIFIC folder has been either de-packaged/deleted?
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.