2

I deleted a user including his files, but then my data was also deleted. I restarted the computer and my account was gone. I created and account with the same name and the account was partially recovered. The Music directory is still there, but all other are gone. The system did not create directories for Documents, Downloads, etc. I get the error message, file not found. I tried testdisk and extundelete but couldn't recover any files. What else can I do?

Federica Rampf
  • 21
  • I assume you have no backups? – Organic Marble Oct 03 '21 at 18:33
  • 1
    If you've already tried data recovery tools, go take the device to a data recovery specialist and pay someone to professionally recover the data. It's expensive. Anything you do with the device in the meantime reduces the likelihood you can recover anything. In the future, keep backups. – Nmath Oct 03 '21 at 18:54
  • I agree with the previous advice, and can add this link: Scroll down to 'Advanced repair of a partition table, file system and/or recovery of files'. ddrescue is a good cloning tool, and when nothing else works, you can resort to photorec, that can recover what is not yet overwritten, but the directory structure and file names are lost. It will be a hard and dirty job, but if professional help is too expensive ... – sudodus Oct 03 '21 at 19:28
  • Questions on recovering deleted files obviously were asked before. It is not trivial. Have a good backup of your personal files anytime. – vanadium Oct 03 '21 at 20:33
  • 1
    I do have backups, monthly. I wanted to delete a guest user and didn't think something could go wrong. It happens. I should have known better.

    I have learned that "TestDisk can sometimes recover recently deleted files using PhotoRec, which is part of TestDisk", so I did that. I have a big puzzle of data, but I found the files I have been working on in the last few weeks. I only need to reinstall Ubuntu now.

    Thank you for the support, including all the times I found solutions to my problems in the forum not asking a question! I have been a Linux and Ubuntu lover for more than 25 years.

     – Federica Rampf Oct 05 '21 at 11:24
  • You are welcome and congratulations to finding the the files you have been working on in the last few weeks :-) – sudodus Oct 06 '21 at 08:05
  • Related https://askubuntu.com/q/3883/305000 – Pratik Feb 08 '24 at 07:18

1 Answers1

4

1.) Recovery from backups

There are two kinds of people: Those, who make backups - and those, who wish they had made backups.

This is an important rule to follow. If you have data, which you can't afford to lose, then you need to make backups of them. If you have backups, then it's easiest to just recover from a backup.

If you have not made a backup yet, then it's too late for the files you already have deleted, but not for all the files you still have. So make a backup of those ASAP.

2.) Professional Data Recovery

Depending on the value of the data, you may have good chances of success with professional data recovery. Turn your device off and keep it turned off!

Contact a professional, explain the situation and ask them for a quote. Keep in mind, they cannot guarantee that they will be able to recover your data, but depending on how valuable it is to you, this may be a viable option.

3.) Recovery Software

If professional help isn't an option, you can still attempt to recover it yourself. Create an image of the partition you have made and write it to an external(!) drive. Don't write it to the same partition your data was on, because you risk overwriting the same data you are trying to recover.

To do that, run the following command:

sudo dd if=/dev/sdXY of=/media/<External>/recovery_image.iso bs=4M status=progress

X and Y are the letter and partition used for your device. For example, if your data partition is /dev/sda3, then write if=/dev/sda3. is the mount point of your external drive.

Afterwards, you have a bit-for-bit copy of your data partition. If your files are still there, you can now attempt to recover them with any available tool.

There are many available, both for Linux and Windows, and you can try multiple. As they all work off the same image file, if one of them succeeds, then you're in luck.

MechMK1
  • 331