files disappeared

[Petter Adsen]

On Fri, 03 Jul 2015 14:01:01 -0500
Linda <haniganwork at earthlink.net> wrote:
> Accidently deleting a file seems possible, deleting all of 
> the files in a directory but leaving the directory 
> especially when just opening a file with libre office seems 
> unlikely, especially deleting them in a way that doesn't put 

It's just as easy to delete one file in a directory as it is to delete
all of them. If it had been a random selection, however...

> them in trash.  I have started wading through the logs and 
> will spend sometime on that but I'm not finding read/write 
> errors. It is ext4 and also is the first machine I have with 
> a solid state drive. It has made we wonder about file 
> system/disk stability so I am busy backing up.  I figured 
> that was the case with locate I had used it to see if I had 
> somehow accidentally moved them. The find suggestion is 
> helpful. Any idea what sort of messages I should be looking 
> for if it is a filesystem/disk issue  a much greater concern 
> than the lost files.

Any message like "input/output error on device sdXX" would be a bad
sign. Basically, any error message at all that mentions a disk device
is not good. You can use smartctl to run self tests on the disks, see
the man page - smartctl is found in the package "smartmontools". You can
also use it to query SMART information from the disk, but I am not sure
what parameters you would want to look at for solid state devices. A
web search would probably tell you.

If the filesystem the files disappeared from is on sdb1, then you could
do a "grep sdb /var/log/kern.log", and see what shows up. Apart from
the initial detection of the device, there shouldn't be many messages
at all, and certainly no error messages.

It is of course possible that you have just gotten a bad SSD, I bought
two identical Kingston SSDs in December that have both died
mysteriously by now. But they both spewed error messages before they
croaked, disk failures have a tendency to be quite noisy.

If you can't find any suspicious log entries, there aren't really that
many options left. Has someone else used the machine, locally or
remotely? Is it possible that the system might have been compromised?
If the answers to those two questions are both "no", and the logs are
clean, then we really end up with "probable user error". There's no
shame in that, it has happened to all of us, I'm just saying that
sometimes the simplest explanation is the most likely one. Occam’s
Razor, and so on.

Petter

-- 
"I'm ionized"
"Are you sure?"
"I'm positive."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 213 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-users/attachments/20150703/e6ee6116/attachment.sig>