files disappeared

[Petter Adsen]

On Fri, 03 Jul 2015 11:15:11 -0500
Linda <haniganwork at earthlink.net> wrote:

> I am using Lubuntu 14.04.2.  I was looking at a file in a 
> directory earlier this morning and everything was fine. Then 
> I went back to check something and every file has 
> disappeared from that directory.
> They do not appear in Trash and they do not appear in the 
> terminal window with a ls -la, however they do appear with 
> locate. They also don't appear in recent opened files in 
> Libre Office even though that is what I looked at them with. 
> Any ideas how or why they disappeared and how I can recover 
> them?

The reason they still appear when you run locate is that locate
searches a database, it doesn't actually search the file system like
for example 'find' does. The database has not been updated since before
the files were deleted, that's why they are still listed.

How/why they disappeared? I don't know. Could be disk/filesystem
corruption (in which case there should be hints in the system logs),
the system might have been compromised, or it could just be user error
(more likely, easy to do). Files generally don't delete themselves
without trace.

How to restore them? That depends on a lot of different things, but
a search engine is your friend there. Assuming the filesystem is ext4,
a quick search would look something like this:

https://duckduckgo.com/?q=undelete+files+ext4&t=canonical&ia=qa

Which returns several useful tips. The third hit from the top looks
promising if you are looking for a quick fix. Skimming through a few of
the other hits would probably be a very good idea, as data recovery can
be a complex process. It could be useful to read up on a couple of
different ways of doing things before deciding what approach to take.

Note: You should avoid installing anything on, and performing as few
writes as possible to the filesystem the files were on until you have
recovered as much data as possible. Make an image of the filesystem on
another device if you can (you can use 'dd' for this), and/or do the
recovery from a live CD. Any writes to the filesystem can overwrite the
space the deleted files occupied, making recovery next to impossible.

Petter 

-- 
"I'm ionized"
"Are you sure?"
"I'm positive."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 213 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-users/attachments/20150703/f3d909b8/attachment.sig>