2

I have launched a live CD session (Ubuntu 8.04) from a USB key on my laptop where Windows XP is installed. During this session I moved various files from Windows XP folders to the Documents folder located on the Ubuntu desktop. Then I removed the USB key because I thought these files would be somewhere on the USB key. NO, they don t seem to be there.

SO I have re-launched the live CD session from the USB key. Surprisingly the files are no longer in the Documents folder on Ubuntu desktop. I mention that i didn't switch off the laptop during all these operations.

Is anyone able to tell me where are these files? Thank you so much.

Eliah Kagan
  • 117,780
ALex M.
  • 23
  • 3
    It looks like you did not make a persistent live image. Unless you have backups, the documents are in document heaven. – AlexP Jan 08 '17 at 18:39
  • 1
    We do not support questions related to end of life releases. 8.04... is ancient and not worth your time Those files are indeed gone: you did not save them in Documents. You put them in memory. When you turn a system of it cleans its memory. – Rinzwind Jan 08 '17 at 18:43
  • 3
    While they are gone at the destination, they may still be recoverable from the source volume. – Eliah Kagan Jan 08 '17 at 19:31
  • @ALex M, Let us hope that you used a standard drag and drop operation from the internal drive to the USB pendrive. In that case you did not move but copy the files, and they are still there in the internal drive. But if you made an extra effort to really move them, things are worse and you need the recovery methods described by Eliah Kagan. – sudodus Jan 08 '17 at 19:43

2 Answers2

3

Unless the system on the USB flash drive was set up with persistence, files saved to the live system are only ever stored in memory, they are not actually saved to a disk anywhere, and so they disappear when you shut down or reboot.

That is, without persistence, a live USB works the same as a live CD or DVD. Saving files on the system running from it does not alter it, and those files are not preserved.

You said you moved the files to the live system. Since the files were on a hard disk originally, moving them into the live filesystem actually consisted of two operations behind the scenes:

  1. The files were copied to the live filesystem.
  2. After the copying succeeded, the files were deleted at the source.

If you have backups, then the solution is simply to restore your documents from backups.

If they're not backed up and are important, then the solution is to attempt to undelete the files from the volume they were copied from. This is not guaranteed to succeed, but especially if you have not written to that disk since, you might actually be able to recover everything.

As with any data recovery operation, the most important rule is do not write to the disk that you need to recover data from. This runs a high risk of overwriting the data corresponding to the files. When a file is deleted, the data associated with it is rarely immediately destroyed. Instead, the locations on disk where the data are stored are made available for subsequent writes. Until something is written over your files, they may be recoverable.

What some people don't realize is that if you have an operating system installed on a disk, just booting the installed OS performs numerous write operations and runs a high risk of overwriting the data from deleted files. Therefore, you must not boot the OS installed on that drive until you've recovered any data you want to recover (or decided, for sure, not to do so). If you have booted from the drive, you might be able to recover data, but the chances are lower.

It is safe to boot from a live CD/DVD/USB when attempting to recover files from an NTFS partition. That doesn't automatically write to any NTFS volumes.

As for where to put the files when you've recovered them, although setting up a live USB with a persistent area is one option, I suggest you go the simpler route of plugging a separate external drive (which could be another USB flash drive) into the computer and storing the files there.

So, that's what happened. The obvious follow-up question, How do I actually attempt to undelete the files? is not inherently about Ubuntu -- they're on a Windows system -- and if you need help with that then you might be better served by a community with more Windows experts that actively solicits Windows-related questions, such as Super User.

However, some approaches to recovering the data can be done using Ubuntu, and those are on-topic for this site. Rather than jumping in immediately and trying things out with the hope they will work, I recommend you take a careful approach. Specifically:

  • Make sure you know how to avoid writing to the affected disk (or, more precisely, the affected partition).
  • Most techniques for undeleting files do not require that the partition be mounted, or even benefit from it being mounted. However, if for any reason you do mount the partition again before you're done recovering files, you should make sure that it is mounted read-only, and not read-write.

As for how to go about recovering the files, see:

Finally, there are three things to keep in mind:

  • Don't write to the volume that contained the files, until you're done recovering data, because that can overwrite the contents of the deleted files. Yes, I've said it before, but I'm saying it again because it is so important.
  • While Ubuntu and other GNU/Linux systems are often used for recovering data from Windows systems, even by users who mainly use Windows, not all methods of doing so use Ubuntu. You may want to look into other methods. And certainly, not all methods are described here. The main focus of this answer is on explaining what happened and how to proceed in general.
  • If at all possible, use a supported release of Ubuntu. You said you're using Ubuntu 8.04. That release is really old and hasn't been supported for years! I'm not saying this contributed to your original problem -- non-persistent live media work the same in every release of Ubuntu -- but it's better to use a supported release of Ubuntu, especially for anything important like data recovery, if you choose to use Ubuntu for that.
Eliah Kagan
  • 117,780
1

First of all, do not use the internal drive for anything but recovery until you have recovered the important files. This is very important. So if you want a drive where you can save files, please create it in another computer.

Please download a current version, the ultra light Ubuntu flavour Lubuntu 16.04.1 LTS 32 bit (alias i386), which is good for an old computer with Windows XP.

Use mkusb to create a persistent live drive in the USB drive. This means that the files you save will be stored in a separate partition, and survive reboot. If you want to read the files when connected to Windows, you should save them in the usbdata partition. Otherwise, you can save them in 'Documents' and the other standard directories of the persistent live system.

See these links

Try Ubuntu (Kubuntu, Lubuntu, Xubuntu, ...) before installing it

help.ubuntu.com/community/mkusb

mkusb/persistent

sudodus
  • 46,324
  • 5
  • 88
  • 152
  • However, if the OP is going to try to undelete the lost files from the NTFS volume, they should not use the system installed on that volume to create new live media. (They shouldn't use it for anything until they're done recovering data or attempting to do so -- they shouldn't boot it at all.) – Eliah Kagan Jan 08 '17 at 19:43
  • 1
    That's right, I will write about that in the answer. – sudodus Jan 08 '17 at 19:49
  • Thank you Sudodus. As you guessed, it's an old computer and that's why I wanted to use an older Ubuntu version (light). But I thank you for mentioning the ultra light 16.04.1 LTS 32 bit. It's exactly what I need. – ALex M. Jan 09 '17 at 18:18