0

I am using Ubuntu 22.04 and have an external encrypted with BitLocker HDD which I use to store sensitive data such as personal and family photos and videos.

Today, as usual, I decided to move some stuff from my laptop to that HDD. The only things I did different were 1. I pressed to remember a password so as not to enter it every time I connect this drive, 2. I used terminal to find path and open nautilus in a specific directory. I usually open two different nautilus windows using GUI but that time I decided to shorten:

  1. I opened both nautilus via GUI with the source folder and terminal so as to find a destination using find.
  2. I ran find /media/user/Transcend -iname "Photo*" to find a directory containing all unsorted photos and used cd to enter into it.
  3. I made sure I was in the right folder executing ls -la. I saw lots of the files with "Photo*" mask.
  4. I didn't want to open another nautilus windows and jump from one folder to another so I just typed nautilus . to shorten instead.
  5. I selected all the stuff I wanted to move from the first nautilus window and pressed Ctrl+X to cut them, switched to the second just opened via terminal nautilus windows and pasted them using Ctrl+V.
  6. I closed the second nautilus windows by Ctrl+W.
  7. Typed ls -la and noticed a really short list of files. It looked like they were moved somewhere or deteled. But I didn't call rm or mv or trash. I also didn't find the new just copied stuff there.
  8. I opened nautilus again and retried to paste some copied files again using Ctrl+C + Ctrl+W and got an error they were already there. But I didn't see any of them nor in terminal ls or find or nautilus.

I tried to umount and mount drive again, extract and connect it, reboot the OS, but nothing helped. find stopped showing disappeared files as well.

After that I tried to repeat those steps and got the same result in a different folder. I am not sure but it seems like free space increased after all and free/used space are not consistent: 530GB used, 220GB free but found content is 382GB only.

I know it sounds unbelievable but I am not that stupid. I have no idea yet how many files I lost.

1 Answer 1

1

I've studied your process flow and if what you posted is the exact commands you issued, you should have been successful in accomplishing what you set out to do.

Not to sound disrespectful, but doing a cut to anything that you don't want to risk losing is a fundamentally bad idea. Much better to do a copy/paste and then if the operation is successful, go back and delete the originals. Ask me how I know.

I'm also not very fond of using shortcuts for very important and potentially risky operations. Shortcuts are definitely not time savers if a procedure goes south on you and you have to spend a lot of time trying to troubleshoot a possible mistake. Again, ask me how I know.

I'm guessing there was a typo that caused the files in question to go off into the vapor. Had you not rebooted the "lost" or even deleted files might have been easier to find. The most likely scenario, based on what you posted, is that you were not actually in the directory you thought you were in when you opened the second nautilus GUI. One last time, ask me how I know. I once blew away an entire system this way.

Thoughts: Mount and decrypt the external storage device and do a find from the root directory to see what comes back.

sudo find / -name *Photo*

If there is evidence that suggests that the lost files are somewhere on a device but can't be found using traditional commands, try a data recovery tool. Here's one example that I've used in the past. There are others and you may have a favorite.

https://www.tomshardware.com/how-to/recover-deleted-files-from-any-drive-in-linux

Just a thought and seems unlikely based on what you posted but it might be that you pasted encrypted files from one directory to another. This could explain the device free space discrepancy.

I'm sure you know that deleted files are never truly deleted in *NIX. Since you decrypted the filesystem they are likely sitting there somewhere just waiting to be found and un-deleted.

sudo apt install testdisk

testdisk

NOTE: An LVM formatted device can complicate matters. You may need to use the “analyze” option for Testdisk to make sense of the drive. And it may take some searching to find a particular folder once you do. Furthermore, the files you’re looking for will not appear in red since they were never deleted in the first place. But once you do find them, the copying procedure is basically the same.

Good luck!

8
  • Thanks you your time and advice! I do care much more about all the files already were on that external drive. I already checked root folder sudo find / -name *Photo* after mounting and decrypting BitLocker and unfortunately did not find old files. Commented Oct 29, 2023 at 7:45
  • I have just tried to mount it on Windows 10 but did not manage and got an error: "The file or directory is corrupted and unreadable". chkdsk also detected indexes errors in read-only mode. I guess I should copy those 382GB data at least and then try to fix file system using Windows. The best option is to create an image of the whole drive but I don't have much free space. Commented Oct 29, 2023 at 7:51
  • Seems like I shouldn't have tried to connect on Windows. Can't mount on Ubuntu now: "Error mounting /dev/-dm-3: Unknown error when mounting /dev-dm3". Commented Oct 29, 2023 at 11:22
  • 1
    Did not managed to fix it using testdisk: analyse partitions took about 3 hours but did not even found any meanwhile disks utility sees them without a scan. The good news is I've successfully restored everything with Window's chkdsk /R /F. The only thing I needed was to unlock BitLocker drive first before executing chkdsk command. Otherwise I got errors like "CHKDSK is not available for RAW drives", convert didn't help and raised the same RAW format error. And unlocking helped. I am really thankful for your participating. Didn't actually expected anyone to answer, to be honest. Commented Oct 29, 2023 at 21:21
  • 1
    Yeah, it would be really presumptuous to do it without a clone ;) I got another drive, which I will use to reproduce corrupting a file system later, and created a whole partition image using Ubuntu's disks utility before trying to modify anything with testdisk and chkdsk. An error was not to do it before running chkdsk in read-only mode which broke mounting on Ubuntu. Thanks for a company again! Commented Oct 29, 2023 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .