6

We were working on writing a paper while logged into an Ubuntu guest account. The paper was saved in the guest account's home directory. The computer froze, so we restarted. Ubuntu purged the files. Is it possible to recover?

Jorge Castro
  • 71,754
  • 1
    A 'guest' account? Were you running from a LiveCD by any chance? I ask, because during installation to a hard drive, Ubuntu should ask you for the name you want to use when you log-in. – pavium Dec 15 '09 at 03:25
  • 1
    No. A friend of mine was working on his paper using a guest account –  Dec 15 '09 at 03:26
  • 1
    Hmmm, I'm using Kubuntu 8.04 LTS, a little outdated perhaps, but there's no sign of a guest account. The latest Ubuntu may be different. Are you saying that the paper was saved, but was later purged by the system? I don't think I have any suggestions, but it will be good to describe as much of the problem as possible before someone more familiar with a later version of Ubuntu comes along. – pavium Dec 15 '09 at 03:39
  • 1
    Have you checked the lost+found directory? –  Dec 15 '09 at 03:43
  • 4
    FYI: When you spawn an Ubuntu guest account it creates a temporary home directory under /tmp. The default Ubuntu setting is to empty /tmp at boot time. – andol Dec 15 '09 at 06:24
  • This explains a lot. So you shouldn't use the guest account for anything you want to be permanent from one boot to another. I wonder if I have a guest account. – pavium Dec 15 '09 at 07:16
  • @andol: that's very good to know. @thuvaraka: so this means there's no way to recover the file.

    As a side note: I guess you should tell people using guests account that they should use online services when creating documents with such accounts (Google Docs or so).

     – raphink Dec 17 '09 at 16:41
  • By the way, shouldn't this kind of question be moved to superuser? – raphink Dec 17 '09 at 16:44

4 Answers4

6

It is not true that there is no way to recover them. It is true that there is no particularly reliable way to recover them. And with all the time that has passed, it is quite unlikely they could be recovered now; I'm really posting this answer for others who experience similar situations in the future.

When a file is deleted, such as files purged from /tmp, the data is not immediately destroyed, and it can persist for an extended time, and it can sometimes be recovered. See https://help.ubuntu.com/community/DataRecovery for information about data recovery in the context of Ubuntu.

Continuing to use your computer after you have deleted files that you want to recover significantly decreases the chance that recovery will be possible. So please do heed this warning (from DataRecovery):

You should NOT write to the failed device, as it can worsen a hardware failure, and overwrite existant data in case of lost files.

Shut down the affected machine as soon as possible, and restart it from a LiveCD or LiveUSB. Be certain that the "live" cd does not automatically mount any partition or swap space.

In other words, stop using the Ubuntu system immediately, and only boot into either (1) a different system installed on the computer, or (2) better, a live CD/DVD or live USB flash drive.

(Thanks to Joseph Kern for pointing out the importance of emphasizing the need to stop using the system if there is to be good chance of recovering deleted files.)

Eliah Kagan
  • 117,780
  • 1
    You should add that they need to stop using the computer right now if they want a chance at recovery. –  Oct 29 '11 at 15:54
1

The first thing to do is to stop using the filesystem immediately, as every write will reduce the chance of recovering files.

I would recommend looking at using ExtUndelete as I have heard good things about it. I noticed that is it now packaged for Oneiric so booting a liveCD and installing it should not be an issue.

Cas
  • 8,557
1

first of all the GUEST account of Ubuntu is NOT like Windows Guest account. Every time you use a guest account the Ubuntu creates a temporary user in the /tmp directory.ALL THE WORK DONE IN THIS ACCOUNT IS DELETED as soon AS THIS Account is LOGGED of.

You should visit this link https://help.ubuntu.com/community/DataRecovery for further details

coder
  • 3,591
0

Based on the clarification given by andol, since all the files were located in /tmp which was purged, there is no way to recover them.

raphink
  • 1,100
  • 2
    Not technically true. /tmp is not formatted on reboot. Recovery is still possible through testdisk, foremost, etc. It just depends on how much time you can spend on recovery. –  Oct 29 '11 at 15:53