Advice needed re folder deletion

[kosymodo]

Hi folks

So, I'm having a bit of a nightmare and I need your help...

Basically, I've recently set up a NAS, and have been consolidating my documents and photos onto it. I took the cautious approach, and copied to the NAS, then, only when I'd confirmed the copy had been successful, I deleted from the source.

The NAS is set up as a RAID1 storage pool. 2x 2TB drives. File system ext4.

Today I decided to attach my external USB drive to the NAS, to transfer some photos. This is where the problems started. Ever wish you could rewind time?

So, I connected the USB drive, and set a task for it to copy the contents to the NAS, giving the destination as as subfolder of a folder named Photos. However, what seems to have happened is that the USB drive was in some way unreadable, and the NAS has mirrored the non-existant contents of the USB drive to the Photos folder. This has resulted in deletion of everything within that folder. It's now an empty folder.

Knowing a little bit from previous experience with file deletion, what I've done is immediately removed one of the drives, and stopped using the NAS completely. Therefore, I have (I'm hoping) a drive in the state immediately post-deletion.

What can I do, if anything? I've just been Googling, and have come across extundelete, but I have to be honest and say I don't really understand it, and it's Linux from what I can tell.

Any suggestions will be most gratefully received!

 

[mrbazmondo]

Mount the disk read only: mount /dev/whatever /mnt -o ro
Then you can try this: https://manpages.ubuntu.com/manpages/precise/man1/extundelete.1.html

Some useful info here: https://unix.stackexchange.com/ques...-a-just-deleted-file-on-ext4-with-extundelete

 

[kosymodo]

Mount the disk read only: mount /dev/whatever /mnt -o ro
Then you can try this: https://manpages.ubuntu.com/manpages/precise/man1/extundelete.1.html

Some useful info here: https://unix.stackexchange.com/ques...-a-just-deleted-file-on-ext4-with-extundelete

Thanks for your reply. Very much appreciated! However, I'm stuck on the very first bit :/ Can I do this in Windows? Those look like Linux commands to me (from my very limited experience with my RPi)

I really need a Dummies Guide on this I'm afraid to say

 

[Murphy]

I guess mrbazmondo gave you Linux commands because your NAS is using ext4, typically a Linux filesystem. What NAS software/OS are you using?

A simple file copy from a USB drive to a folder on Linux shouldn't/wouldn't typically mirror or wipe-out the contents of the existing folder, it should work much like it does in Windows. Could it be possible that you mounted the USB drive to the Photos folder? As from what i remember that can make the existing content of the folder temporarily hidden.

 

[kosymodo]

I guess mrbazmondo gave you Linux commands because your NAS is using ext4, typically a Linux filesystem. What NAS software/OS are you using?

A simple file copy from a USB drive to a folder on Linux shouldn't/wouldn't typically mirror or wipe-out the contents of the existing folder, it should work much like it does in Windows. Could it be possible that you mounted the USB drive to the Photos folder? As from what i remember that can make the existing content of the folder temporarily hidden.

It's a Terra-Master NAS, running TOS.

God knows what happened, but it does seem to have deleted the contents of the Photos folder completely. I have the HDD safely out of the NAS, pending some investigation on how to attempt data recovery.

If I need to use Linux to attempt the recovery, then so be it, however I've no experience with Linux at all (except for my dabblings with my RPi). I have now installed Ubuntu on a spare laptop though. There's no rush to getting started on this, I think it's gonna be a steep learning curve to get my head around Linux and what's required to attempt data recovery. That's why any advice I can get from you guys will be so much appreciated!

 

[VersionMonkey]

So, I connected the USB drive, and set a task for it to copy the contents to the NAS, giving the destination as as subfolder of a folder named Photos.

It might be useful to know, step by step, what you did here. That might help understand what went wrong and from there what might be done to recover the data.

 

[kosymodo]

TerraMaster support have come back to me with this - The mirror backup method will overwrite all the contents of the destination folder while backing up the data. You can try to find a professional data recovery company.

What I was looking to do was to attach my external USB drive to my NAS, and to transfer the photos I had on there onto my NAS. I installed a TerraMaster app called USB Copy, and set the task to mirror my USB drive to a subfolder of my Photos folder on the NAS. What happened though was that it deleted the contents of the Photos folder, rather than adding the USB's photos to the subfolder. It's read nothing on the USB drive, and has I guess mirrored nothing to the Photos folder, resulting in deletion of the folder's contents.

The task was set to mirror one way only (i.e. USB to NAS, not NAS to USB), which I thought would result in the USB contents being added to the subfolder. Checking the task now, I can see that the backup destination (for whatever reason) was actually the Photos folder itself.

I'm estimating roughly 200GB of photos were deleted, and am hoping that these haven't actually been overwritten as such. The log of the task appears to show 45 seconds of activity, which I'm hoping means that the folder contents weren't overwritten, merely the references to the files have been amended (or whatever the correct jargon is)

 

[VersionMonkey]

Without knowing the TerraMaster software it is hard to be sure, but it seems probable that the existing files were just deleted and not overwritten. If there has been no new data written to the drive then the extundelete command referenced by @mrbazmondo stands a good chance of recovering the files.

You say you have a spare laptop with Ubuntu - have you attempted to connect the drive to the laptop yet?

 

[kosymodo]

Without knowing the TerraMaster software it is hard to be sure, but it seems probable that the existing files were just deleted and not overwritten. If there has been no new data written to the drive then the extundelete command referenced by @mrbazmondo stands a good chance of recovering the files.

You say you have a spare laptop with Ubuntu - have you attempted to connect the drive to the laptop yet?

Exacly, that's my hope, that no overwriting has happened. It would seem unprobable (to me anyway) that 200GB would be overwritten in 45 seconds, on a home-user NAS. But I confess to not having the slightest clue about that side of things!

I haven't done anything with the drive yet, I've simply installed Ubuntu on the laptop. I have (or had) an external HDD docking station, which connects by USB, but I need to have a dig around in the garage to see if I threw it out when I moved home last year. What I do know, and what scares me a little, is that as soon as I connect the drive, it's at that point I risk (further) data deletion/overwriting. Therefore I won't be connecting it until I'm absolutely sure about the procedure I'm gonna follow. I'll need to fully understand how to mount a disk as read-only before I even contemplate connecting it

 

[VersionMonkey]

Exacly, that's my hope, that no overwriting has happened. It would seem unprobable (to me anyway) that 200GB would be overwritten in 45 seconds, on a home-user NAS. But I confess to not having the slightest clue about that side of things!

I haven't done anything with the drive yet, I've simply installed Ubuntu on the laptop. I have (or had) an external HDD docking station, which connects by USB, but I need to have a dig around in the garage to see if I threw it out when I moved home last year. What I do know, and what scares me a little, is that as soon as I connect the drive, it's at that point I risk (further) data deletion/overwriting. Therefore I won't be connecting it until I'm absolutely sure about the procedure I'm gonna follow. I'll need to fully understand how to mount a disk as read-only before I even contemplate connecting it

The safest approach is to take an image of the disk before trying to recover the data and recover from the image rather than the disk. To do that, though, you need to have some other storage that is at least the size of the disk you are trying to recover from.

It looks like both extundelete and a similar command ext4magic write recovered files elsewhere - which would also protect the integrity of the disk.

So as well as finding the USB dock, do you have plenty of extra storage to (a) take a disk image and/or (b) store the recovered files?

 

[Murphy]

What I do know, and what scares me a little, is that as soon as I connect the drive, it's at that point I risk (further) data deletion/overwriting. Therefore I won't be connecting it until I'm absolutely sure about the procedure I'm gonna follow. I'll need to fully understand how to mount a disk as read-only before I even contemplate connecting it

I'm fairly sure that's only a risk with some Windows based recovery software, I'd do as VersionMonkey suggests first with something like Clonezilla to clone the drive before trying to recover the files.

 

[kosymodo]

Hey guys, sorry for the radio silence the past few weeks. Work has been super busy, so haven't had a chance to even move forward one bit with this.

Today I've enlisted the help of one of my friendly colleagues from our IT dept to look at this with me. He's really up to speed with everything network- and storage-related, so I had good optimism about tackling it. However, we've run into some issues. The disk mounts fine (read-only!) in Linux, the disk itself seems to be OK, but the extundelete command isn't able to recover anything due to there being no journal (or journalling being disabled). Therefore a more thorough approach looks like it's gonna be necessary. I'd already bought myself a new external HDD docking station, which I'm currently using to clone the drive, so that we can attempt a more robust approach tomorrow.

So, just to be clear...in answer to @VersionMonkey yeah I have a couple of spare 2TB HDDs, one of which I'm cloning the source drive to, and the other on which I'll be able to store any recovered files. Then, in answer to @Murphy I'm using the docking station's 'offline clone' function to clone the drive. Thought I may as well give that function a go before using any other software to facilitate the clone.

I'll report back when I have more to share. Thanks all for your help thus far, it's very much appreciated!