I've burned a portable Ubuntu ISO onto a USB and booted it up on Macbook Pro 2017. I've selected the "try Ubuntu" option.

After using it for ~36 hours, I click "Suspend". Now, when I boot up the laptop again into Ubuntu and selected the "try Ubuntu" option, I see that it's a brand new copy—my 6 files on the desktop are no longer there.

What happened? How can I recover the lost data?

  • When you selected Try Ubuntu again, it started a new session with a fresh set of data in RAM. This is how a live DVD disk or live USB pendrive works. But you can add a file with the name casper-rw or a partition with the label casper-rw, where installed programs tweaks and personal files are stored. An alternative is to install Ubuntu into a fast USB pendrive (installed like into an internal drive, but into a USB drive). See this link, Try Ubuntu (Kubuntu, Lubuntu, Xubuntu, ...) before installing it
    – sudodus
    Mar 1 '18 at 19:49
  • @sudodus, You mean the files saved on the desktop are directly stored in ramstick and had not even once touched the platters of the USB device? What should I do right now to maximize the chance of getting the 6 files back?
    – Pacerier
    Mar 1 '18 at 19:50
  • Yes, in a live (live-only) system, even in a USB pendrive. You need 'at least' a persistent live system. I am very sorry, but I am afraid, that the files are lost in cyberspace. If you have not restarted the computer, there might be some advanced method or tool. It is beyond my knowledge.
    – sudodus
    Mar 1 '18 at 19:52
  • @sudodus, Hmm, but clearly I selected "suspend", if "suspend" does not "suspend" what does "suspend" do then?
    – Pacerier
    Mar 1 '18 at 19:54
  • I don't know, but maybe there is a clue at the following link, Accidentally did dd /dev/sda. See the accepted answer (with the tick in a green circle). -- I think you need help from someone who knows more about this than I do.
    – sudodus
    Mar 1 '18 at 19:58

You stored those files in RAM and they are gone

It's that simple, really. If you cared about the data in those files you should not have chosen a session that is advertised as "not doing any changes to your computer".

Or, at least, you should have saved them in an external drive.

RAM is a volatile kind of memory. Do not believe those who talk about recovering data from it after the computer has been switched off. It is not possible, the so called "cold boot attack" is basically impossible to put in place unless you happen to carry around some liquid nitrogen and apply it seconds after the fact. Then maybe it could work.

No DFIR expert nor data recovery company can do anything about your RAM after it has been turned off.

Recreate those files from scratch.

  • Re "you should have saved them in an external drive"; Right, but the main issue is that Ubuntu already itself was installed in an external drive, Thus it's just way too astonishing in terms of security and data integrity that the files saved on the desktop are warninglessly "saved" but saved not onto the portable Ubuntu thumbdrive.
    – Pacerier
    Mar 2 '18 at 19:32
  • @Pacerier it is not installed on the drive, it is generally flashed on the drive. Also, when you boot a pop-up appears warning that you are in a live session. Mar 2 '18 at 22:03
  • ? No warning.͏͏͏͏
    – Pacerier
    Mar 5 '18 at 6:01

Whenever you run a live CD, everything you do is saved in memory but not onto your actual hard drive. It might be possible to recover the information from your memory if you're really lucky and have access to some good forensics tools but in all likelihood, your data is gone. If you want to use Ubuntu on a live cd and save your data, you must save it to some storage like a USB drive or your hard drive where your Mac install is located.

If you really like Ubuntu, I think Macs have something called bootcamp that allows you to partition your hard drive and dual boot Mac OS and Ubuntu. I'm not sure if Mac support it, but you could also install Ubuntu to a flash drive and boot from that which will allow you to preserve data.

  • Hi, I really need the 6 files back. What should I do right now to maximize the chance of getting it back?
    – Pacerier
    Mar 1 '18 at 19:48
  • There really isn't a whole lot you can do, you can get stuff from your memory using forensics but that is very very difficult and typically only works for about an hour after a machine has been powered off reliably. It's kind of harsh but my best advice is to save files with redundancy if they are really important. That means saving them to the cloud and your own physical storage.
    – Desultory
    Mar 1 '18 at 19:52
  • Hi, I'm still within that important hour. Any ideas what I can do right now? Is what I need a tool to clone the contents of the macbookpro in-built ramstick?
    – Pacerier
    Mar 1 '18 at 20:03
  • When you rebooted, your RAM was likely wiped and overwritten by the reboot and the new instance of MacOS or Ubuntu. Your files are probably gone forever already. If you truly wish to pursue the low likelihood of data recovery from RAM, then stop using the machine right now. Use a different machine to start research commercial data recovery from RAM.
    – user535733
    Mar 1 '18 at 20:22
  • @user535733, Pity I don't live in America.. there's no access to good commercial data recovery in SG, a small country barely 50 yrs old. Led me to here: security.stackexchange.com/q/180789/2379
    – Pacerier
    Mar 1 '18 at 23:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.