1

I want to recover files deleted by accident. I know how to recover the files using testdisk/photorec. This post is not about how to recover files. It is about how an Ubuntu live USB handles downloaded data.

I have a bootable flash drive with Ubuntu on it already and considered using it to avoid changing anything on the computer's hard drive. However, I was advised that there are some circumstances where Ubuntu will use the host computer's hard drive even when booting from a secondary drive, with little explanation as to how or why. I have seen in my research that Ubuntu will use either the computer's RAM or a file to preserve its state, which is also not saved on the host's hard drive. I am working with conflicting information.

I plan to recover the files using PhotoRec from a live usb, copying the recovered files to an external hard drive. I want to do everything I can to avoid touching the computer's hard drive until after PhotoRec is run.

My question is, how does an Ubuntu bootable drive handle downloaded data (such as packages and apt updates)? What happens if the amount of data downloaded exceeds the size of the RAM cards installed?

Also, as a side note, does anyone know off the top of their heads where I can find the code that would answer these questions? It may be obvious, but I can't seem to find it.

strawberry_kittens
  • 13

1 Answers1

2

The interactions between live USB and your hard drive are determined by you. If you run out of RAM it will write to a swap file (not on your deleted files). In Ubuntu LINUX OS, those deleted files are put in a area called "trash" and reserved in case you want to restore them. (If you emptied your trash bin and you are trying to recover the deleted files..... DO NOT write anything to that disk). A live USB boots and operates independent and mounts the other drives it does not change them, unless you tell it to. Note: There is also a restore from trash feature. Recover

Create a Ubuntu Live USB with Persistent Storage. Boot up on that Live USB. It will mount the Hard Drive, go to the Trash Bin and Copy/Paste those files onto your Ubuntu Live USB. (You may have to set privilege and permissions "chown/chmod")

I understand the question better now than at the first. If the file is very large, there is a option to split the file into parts. here

Nishnabe
  • 389
  • Do you know where downloaded files are held when you are booted into a live USB? What happens if the downloads exceed the RAM available via RAM cards? Would Ubuntu simply say there's no more room, or use the hard drive to give itself more, albeit slower, RAM? – strawberry_kittens Jan 12 '24 at 23:35
  • 1
    @strawberry_kittens I have no idea, but consider this: on the computer's primary hard disk, is there a swap partition, or did you use a swapfile without a dedicated partition? (Nowadays the latter is trending.) I'd say, if there is no swap partition on the primary disk, then there is no concievable way believing that the live Ubuntu session would arbitrarily jump on the primary disk overwriting random things. Noone would code an OS to work like that. However, if there is a dedicated swap partition present, that could possibly be recognized for this purpose? I don't know. – Levente Jan 13 '24 at 00:23
  • @strawberry_kittens also, while I have no idea if it would happen —in case of a dedicated swap partition being present— but for recovery, it could also matter where that partition is on the disk related to the location of the partition that contains your to-be-saved files. If the swap partition is towards the end of the disk then it would be less of a worry if it gets used. But if that swap partition precedes the payload-containing partition, who knows, could that play a role? No difference? These all are just guesses, I have no idea about this. – Levente Jan 13 '24 at 00:28
  • 1
    @strawberry_kittens If you create a live USB with persistent storage it will save downloaded files on the live USB itself.If you exceed the "static" ram, it writes to a swap file on the live USB. The only way those "deleted" files could be overwritten, is is YOU DO IT. Don't write to that drive if you have removed them from the trash bin. I'm assuming you have a very small RAM? – Nishnabe Jan 13 '24 at 01:29
  • More like very large files. Thank you for making a guess. – strawberry_kittens Jan 13 '24 at 02:39
  • 2
    @strawberry_kittens, According to my experience, a live Ubuntu system (typically booted from USB) will grab 'every' available swap partition. So I can confirm the statement of Levente, that a live system can write onto the internal drive (but only into the swap partition). A live Ubuntu system will not mount partitions on the internal drive automatically, and for that reason will not see a swap file. -- A corner case: If you create a partition on the internal drive with an ext file system and the label writable, the live Ubuntu will use it for persistence (and write to it). – sudodus Jan 13 '24 at 09:28