0

Yesterday I made a bad mistake and ran sudo rm -r * in my home directory (it ran for maybe 10 seconds before I realized something was wrong and stopped it). I posted last night but am still having trouble with things.

One of the issues is that I do not know exactly what was and wasn't deleted (if there is a log of this, that would be amazing) and I did not back up my system. I am running an archlinux distribution with LUKS encryption on a Dell XPS 15 9570 which I installed using these instructions and have specific configurations for DWM, DWMBLOCKS, ST, alacritty, zsh, neovim, SXHKD, emacs, and probably something I am forgetting.

I have tried looking online for the best solutions but have found mixed advice and I think I need more explicit instructions than the ones I received here yesterday. Based on what I read and was told yesterday, what I need to do is...

  1. create a copy of my current file system and try to back up any of the configs and files which are still present or restorable on the system
  2. create a dump of deleted data over the past two days and try to restore any important files from there
  3. reinstall system from scratch and back everything up this time

Right after the deletion I poked around in a panic to see what was broken instead of shutting my computer off immediately. I ran sudo pacman -SYYU, opened emacs to see if it was working, reinstalled anaconda because emacs said that there was a version error due to data being deleted from that directory, and I also reinstalled a cached version of a program which I needed for emacs.

After getting advice from the forum, I have only been booting into the system via live USB. I first tried doing things w/ slax but I could not download and make extundelete, so I retried by making a kali-linux live bootable USB. One other issue is that when I thought I had created the live-bootable kali-linux USB, I had instead created a USB installer by accident and went through the installer up to the point of setting the language for the system. I aborted the installation and formatted my flash drive correctly, but I am not sure if this changed anything drastic. After I got the live usb formatted correctly, I ran photorec twice (because I could not figure out how to get extundelete to work properly), once briefly with all file-formats checked, and then another time to extract all PDF and text files created which I stored on a 128Gb SD card. I did not find any dotfiles from this method. I figured out how to properly build extundelete (and ext4magic) and tried running commands to store data over the last 2 days but I keep running into segmentation faults. I also looked into testbench, but the option for data recovery did not appear. One other issue in all of this is that using the kali linux GUI I unmount the largest partition, but I am not sure exactly if this is the right partition to unmount. I looked into using grep to reconstruct files from unallocated memory and I am afraid I am unmounting and creating temporary directories in a way which overwrites data. I have also had to shut down and restart the computer multiple times (always booting from the live-usb), so I am not sure how that affects things...

Lastly, before I really knew what I was doing I came across this blog post, and I ran sudo uname -a, sudo fdisk -l, and sudo blkid and got the following output...

$ sudo uname -a
Linux <redacted> 6. 1.8-arch1-1 #1 SMP PREEMPT_DYNAMIC Tue , 24 Jan 2023 21:07:04 +0000 x86_64 GNU/LinUx
$ sudo fdisk -
Disk /dev/nvmeen1: 238.47 618, 256860514384 bytes, 590118192 sectors
Disk model: KXG50ZNV256G NVMe TOSHIBA 2566B
Units: sectors of 1 * 512 - 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/0 size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk 1dentifier: <redacted>
Device
start
End
size Type
Sectors
2848
/dev/nvmeonip1
10586231848576 5 12N EFI System
/dev/nvmeen1p2 1050624 2099199
1848576 512M Linux filesystem
/dev/nvmebnip3 2999289 598117503 498818384 237.56 Linux filesystem
Disk /dev/mapper/volumegroup: 237.46 618, 254968594432 bytes, 497989536 sectors
Units: sectors of 1 512 - 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/0 size (minimum/optimal): 512 bytes / 512 bytes
Disk /dev/mapper/volumegroup-root: 58 618, 53687891280 bytes, 184857689 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/0 size (minimum/optimal): 512 bytes / 512 bytes
Disk /dev/mapper/volumegroup-home: 187.46 618, 281288454656 bytes, 393125888 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/0 size (minimum/optimal): 512 bytes / 512 bytes
$ sudo blkid
/dev/mapper/volumegroup-root: UUID="<redacted>" BLOCK_SIZE="4896" TYPE="ext4"
/dev/nvme@nip3: UUID="<redacted>" TYPE="crypto_LUKS" PARTUUID="<redacted>"
/dev/nvme@n1p1: UUID="<redacted>" BLOCK_SIZE="512" TYPE-"vfat" PARTUUID="<redacted>"
/dev/nvme@n1p2: UUID="<redacted>" BLOCK_SIZE="4096" TYPE-"ext4" PARTUUID="<redacted>"
/dev/mapper/volumegroup-home: UUID="<redacted>" BLOCK_SIZE-"4896" 

Again, any help w/ clear instructions geared towards a new person would be greatly appreciated. Thank you.

4
  • 1
    If you were using ext2/3/4, boot from livecd/liveusb and run extundelete (it requires unmounted file system). Note that you'll need an additional device where salvageable data could be copied; it couldn't just "revert the state of files" in place. Then, after having saved everything it could save, you may do whatever you want. Important thing is that should be done as early as possible. Jan 30, 2023 at 6:59
  • 2
    I suppose suggesting you restore from your most recent backup would just be cruel. But when you do get your files back or rebuild them, consider at least putting your dotfiles in an online version control system.
    – MDeBusk
    Jan 30, 2023 at 7:06
  • To find out which filesystem it is, run blkid, or, mount if it's still mounted (should be not, I already told you!). Jan 30, 2023 at 8:12
  • Well, as I already said, you may proceed with my answer. Notice that, unfortunately, slax automounts anything it can, so after it boots you'll need to unmount the volume again. The utility will warn you and refuse to operate it you forget it, though. Jan 30, 2023 at 11:27

1 Answer 1

2
  1. You should stop writing into this file system, as early as possible. Until you are sure you are done salvaging, you shouldn't ever write into it. You may store the dump of the file system anywhere and try again indefinitely.
  2. Use extundelete for ext3/4, or probably there are other utilities like this for other file systems. It requires an unmounted file system, so make yourself some LiveCD or LiveUSB with that utility. slax (Debian-based one) allows you to easily install the utility in runtime. The utility also doesn't allow to store recovered data on the same file system it recovers, it can't revert the deletion in place, so you'll need some additional storage where it copies salvageable data.
  3. After saving anything you wanted, or after storing a dump, you may proceed. If you really only wiped your $HOME and didn't touched the files outside it, you don't need to reinstall the system. Just remove (backup somewhere, just for the case) all leftover files from $HOME (including hidden ones) and login "from scratch". Then you may copy the recovered data into it.

I mentioned dump; one strategy is to unmount /home, make the dump or even block-level snapshot (if it's on LVM), installing the utility into the running system, fixing the emacs and whatever you want to fix, and then using the utility to recover from the dump or snapshot. Just make sure you'll don't run out of snapshot space in that case.

Don't rely on filesystem-level snapshots, e.g. if that was ZFS, the snapshot on that level won't help you with salvaging!

4
  • Thank you for your response. I did recreate the \Documents, \Pictures, and \Downloads directories and reinstalled conda using the installers because that was the issue with emacs and ran sudo pacman -Syyu and reinstalled a cache version of one program. I will stop modifying anything on the system other than that. I hope that did not ruin everything. Can I create the live usb from this computer or do I need to just not touch this until I am ready to extract files?
    – user432111
    Jan 30, 2023 at 7:18
  • 2
    @user558652 stop using the affected computer. You need to use another system to create the live USB. Jan 30, 2023 at 7:26
  • What makes you say that ZFS filesystem snapshots won't help? Certainly a zfs snapshot taken after the deletion won't help, but any snapshots taken before the disaster will be fully recoverable (and can be copied from the dataset's .zfs/snapshot/ directory even if snapdir=hidden. or use zfs rollback). That's why I have a cron job to snapshot all my datasets every hour (so, at worst, I will lose an hour of work), and a nightly cron job to zfs send to my backup server (which has a much longer retention policy for old snapshots than my workstation machine).
    – cas
    Jan 30, 2023 at 11:37
  • @cas very true, but if the snapshot was taken before deletion, the question wouldn't arise at all. I am considering the situation that happened in the question: the deletion already taken place, how to recover? ZFS snapshot won't help to retain the filesystem state "just after deletion" for later forensics (this is what LVM snapshot will do in contrast with ZFS and the reason for suggesting a snapshot in the first place). Jan 30, 2023 at 12:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .