Recovering data after emptying trash

Question

I saw something unusual on my desktop. I deleted it and never saw that I emptied my whole laptop drive, further I emptied the trash moments later. When I noticed it, I tried to recover using Testdisk, seeing How to recover deleted files? and with help of this site: https://www.makeuseof.com/how-to-recover-lost-damaged-data-with-testdisk/

There was no partition in my disk. I started testdisk with creating logfile.`

elect a media (use Arrow keys, then press Enter):
>Disk /dev/sda - 1000 GB / 931 GiB - TOSHIBA MQ01ABD100
 Disk /dev/sdb - 1000 GB / 931 GiB - Seagate Portable
 Disk /dev/mapper/ubuntu--vg-root - 995 GB / 927 GiB - TOSHIBA MQ01ABD100
 Disk /dev/mapper/ubuntu--vg-swap_1 - 4064 MB / 3876 MiB - TOSHIBA MQ01ABD100
 Disk /dev/dm-0 - 995 GB / 927 GiB - TOSHIBA MQ01ABD100
 Disk /dev/dm-1 - 4064 MB / 3876 MiB - TOSHIBA MQ01ABD100
 Disk /dev/loop0 - 66 MB / 63 MiB (RO)
 Disk /dev/loop1 - 521 MB / 496 MiB (RO)
 Disk /dev/loop10 - 470 MB / 448 MiB (RO)
 Disk /dev/loop11 - 524 KB / 512 KiB (RO)
>[Previous]  [  Next  ]  [Proceed ]  [  Quit  ]

I chose >Disk /dev/sda - 1000 GB / 931 GiB - TOSHIBA MQ01ABD100

I got `

Disk /dev/sda - 1000 GB / 931 GiB - TOSHIBA MQ01ABD100
Please select the partition table type, press Enter when done.
>[Intel  ] Intel/PC partition
 [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map (legacy)
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection

` I chose Intel and got

`

Disk /dev/sda - 1000 GB / 931 GiB - TOSHIBA MQ01ABD100
     CHS 121601 255 63 - sector size=512
 [ Analyse  ] Analyse current partition structure and search for lost partitions
>[ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ MBR Code ] Write TestDisk MBR code to first sector
 [ Delete   ] Delete all data in the partition table
 [ Quit     ] Return to disk selection

`

On Analyse I got `

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63 Current partition structure: Partition Start End Size in sectors

1 * Linux 0 32 33 62 53 55 997376 2 E extended 62 86 23 121601 57 56 1952522242 5 L Linux LVM 62 86 25 121601 57 56 1952522240

`

It was dead-end, it asked nothing to do there. So I got to the previous screen and chose Advaned

It gave me `

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition                  Start        End    Size in sectors
> 1 * Linux                    0  32 33    62  53 55     997376
  2 E extended                62  86 23 121601  57 56 1952522242
  5 L Linux LVM               62  86 25 121601  57 56 1952522240
 [  Type  ]  [Superblock]  [Undelete] >[Image Creation]  [  Quit  ]

'

On choosing the 2nd part > Extended I got only these option: `

Partition                  Start        End    Size in sectors
  1 * Linux                    0  32 33    62  53 55     997376
> 2 E extended                62  86 23 121601  57 56 1952522242
  5 L Linux LVM               62  86 25 121601  57 56 1952522240
 [  Type  ] >[Image Creation]  [  Quit  ]

`

It did not show which files to recover, so I selected to create image of the partition, which gave me `

Please select where to store the file image.dd (999691 MB), an image of the partition Keys: Arrow keys to select another directory C when the destination is correct Q to quit Directory /home/alpha >drwxr-xr-x 1000 1000 4096 10-Oct-2023 15:49 . drwxr-xr-x 0 0 4096 28-Aug-2022 23:19 .. drwxr-xr-x 1000 1000 4096 28-Jun-2023 18:41 Documents drwxr-xr-x 1000 1000 12288 7-Oct-2023 15:22 Downloads drwxrwxr-x 1000 1000 4096 17-Sep-2023 21:30 Eternal hard disk drwxr-xr-x 1000 1000 4096 28-Aug-2022 23:30 Music drwxrwxr-x 1000 1000 4096 29-Sep-2023 20:43 Para drwxr-xr-x 1000 1000 4096 28-Aug-2022 23:30 Videos drwx------ 1000 1000 4096 5-Aug-2023 23:18 snap -rw-r--r-- 1000 1000 1037917997 12-Dec-2022 08:32 Heat1995[13gb].mp4 -rw-rw-r-- 1000 1000 66719 10-Oct-2023 15:49 Screenshot from 2023-10-10 1 -rw-r--r-- 1000 1000 1751858879 6-Oct-2023 22:11 The.Drop.2014.m720p.rar -rw-rw-r-- 1000 1000 267 6-Oct-2023 22:11 The.Drop.2014.m720p.rar.aria -rw-r--r-- 1000 1000 1187407 20-Oct-2022 10:07 hrmd2022654.pdf -rw-rw-r-- 1000 1000 4942 10-Oct-2023 17:07 testdisk.log

`

This is where I am facing two problems:

It is said not to copy files to the same location where it belonged, so I wanted to copy the files to an external hard drive. My external hard drive it connected to my laptop but the list doesn't show it. So I cannot choose it.
I don't have an empty 1TB External HDD ready in my hands to copy that image.

So what to to?

Note: I did not use the drive to copy other files, so nothing is overwritten. I just downloaded Testdisk.

Edit 1: I never had to use passcode to open my folders. or used any to my laptop drive. I only have to give password when opening my laptop ie when the ubuntu screen comes.

"Encryption would require you to enter a passphrase when you turn the computer on, before the login password." -- No such passphrase was required for me before user login password.

Edit 2: "What happens if you choose option "5 L Linux LVM"? It may give you more options with folders and files." -- Nothing other than the imaging option.

`

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63

Partition Start End Size in sectors 1 * Linux 0 32 33 62 53 55 997376 2 E extended 62 86 23 121601 57 56 1952522242 > 5 L Linux LVM 62 86 25 121601 57 56 1952522240

[ Type ] >[Image Creation] [ Quit ]

`

@user68186 do you have any idea what is this date in -rw-r--r-- 1000 1000 1187407 20-Oct-2022 is , is it creationo date or last modified date ? — Spectra, Oct 10 '23 at 12:40
@user68186 Like you said earlier, maybe there is no option but to but another 2Tb hard disk. Still there's this problem, it doesn't show any external HDD when choosing the location to copy the image! Which means I'll have to copy that image on my laptop's hard drive, isn't it? — Spectra, Oct 10 '23 at 13:31
Copying the image on your computer's hard disk may not neither possible (you will run out of disk space) and is not recommended. Putting the image in the same disk you are trying to recover the data from defeats the purpose, as it will overwrite everything in that disk. The image in question is the image of a partition that is almost 1TB and the the image will be equally big. So, if you put the image in your hard disk of the computer, there will be room for nothing else, no Ubuntu, no personal files. — user68186, Oct 10 '23 at 14:47
You may want to follow this tutorial. Also see this one. How old is your laptop? Does it have an UEFI and was Ubuntu installed in the UEFI mode (or the legacy BIOS mode)? If the former, you should choose "EFI GPT" as partition type. — user68186, Oct 10 '23 at 15:57
See How can I detect whether my disk is using GPT or MBR from a terminal? If GPT then choose "EFI GPT" — user68186, Oct 11 '23 at 16:45

Recovering data after emptying trash

0 Answers0