Devastating slight of hand- deleted directory by mistake

Support
1

In just a few moments on Manjaro, I accidentally deleted a very important directory full of files, instead of an empty directory I wanted to clear out.
Since my copy of Manjaro gives both “Delete” and “Move to Recycle bin” options, I had no such luck of going to Trash and recovering. For my finger-fumble chose “Delete”, which was the first option, and not “Move to recycle”. It happened instantaneously, boom, vanished.

Now I’ve spent the entire morning looking at tools like extundelete, and ext4magic- which claim to allow you to undelete files if you act FAST, and don’t use your PC at all.
Great.
So now I’m stuck with my PC paralyzed, can’t do anything on it until I can figure out how to rescue my deleted directory.

It seems the greatest problem I am facing, is the deleted directory was in the /home filesystem, which Manjaro won’t allow me to unmount. But the tools won’t work, with the filesystem mounted.
Everything, everything says you must boot to a Live USB first, then unmount the /home filesystem, then you can use the undelete commands.

Well lucky me, I have a Manjaro bootable USB.
Unfortunately, it doesn’t come with the undelete tools, extundelete, and ext4magic! And its impossible to install them, because the bootable USB is read-only.
Well isn’t that a Catch-22 on a Catch-22.

There is also talk of booting Manjaro into “Single User Mode” in order to permit you to unmount /home, which is impossible normally- it always says “Busy”. But the best I can get to is a GRUB> prompt, which allows no use of any tools whatsoever.
Can anyone help? This seems a simple thing, for someone who knows how to do it. The tools to undelete an accidentally deleted file are there, but how in the world do you execute them? And as I said I can’t use my computer at all until I figure out whether I can recover the lost directory.
Thanks much!

2

if you are using ssd with trim enabled, the files are gone… the possibility of recovery is zero…
in the meantime go to system settings/systemd, check under units show inactive and show unloaded, and search for fstrim, and right click and stop the service, wait and again right click and mask the service, and wait till someone more experienced in this comes to aid…
dont forget to enable again the services after this is resolved!!!

@winnie could you please help here

3

There is the possibility of update-able (Live) USB-Sticks

(search for alma - where you can add what you want :wink: )

In the future you could use timeshift or another automatic backup

(But this needs space on an intern or extern device)

Make Backups:

Or you could use btrfs which is capable of snapshots

(where you can recover any deleted file/dir within reach of the snapshots)

You can find good Information about Btrfs in the wiki

4

You should not use that instance of Manjaro whatsoever, as simply idling and using your laptop can still issue writes to the filesystem, such as cache, config changes, etc. If you’ve mounted your /home filesystem with the discard option, then you’re in even worse shape. Also true, like @brahma mentioned, if you’ve enabled the fstrim.timer.

What makes things more complicated is that metadata can be overwritten, even if the actual user data (the files themselves) remain intact. This means that while data recovery is possible, you will lose timestamps, filenames, directory trees, etc. Recovery tools, like photorec can “recreate” some filesystem metadata using “clues” by inspecting the contents of the recovered files. For example: JPEG image EXIF data, Word Document metadata, and other such “clues”.

In my opinion, I always consider the data “essentially gone”, and rely on backups, rather than resort to last-ditch emergency attempts at recovery.

You can still install tools from the repositories in a live USB, such as pamac install testdisk

If you’re feeling more savvy, you can use specialized live USBs, such as Parted Magic, or SystemRescue, or GParted Live.

I’ve never used extundelete, and it appears it hasn’t been updated since 2013 (almost 10 years ago.) I cannot vouch for how effective it is. However, Parted Magic includes it by default, and it’s also available in the Arch AUR. It’s not without reason that you can build the package with Pamac (or manually), while in a Manjaro live USB session.

1 Like
5

I guess I should have sharpened my questions to be more specific:

  • Too late of course to have done a backup before it happened. Yes I’ve done backups, but not lately. I’m not interested in self-flogging at this point. Though I know others certainly always delight indulging in “shoulduvs”. Its a perpetual Internet favorite.

  • There are some Linux tools, extundelete, and ext4magic, which I would very much like to learn how to use in a practical way. I think they are useful.
    But it appears they don’t work unless you can unmount the filesystem in question. It appears you cannot unmount the /home filesystem, unless you boot from a bootable USB, and /home its likely where most deleted files will be on the average system. But then you don’t have these tools, which for some reason are left out of the standard bootable iso package. So how to add them exactly to the USB instance, so that you may then unmount /home, and execute them properly as required? Otherwise these tools as written are useless. Weird that practically all writeups on using them seem to sidestep this.

– >> However, Parted Magic includes it by default, and it’s also available in the Arch AUR. It’s not without reason that you can build the package with Pamac (or manually), while in a Manjaro live USB session.>>>

I’m totally missing what you are saying here.
Are you referring to building a completely new bootable live USB with Pacmac added, or somehow using Pacmac to add Parted Magic to an already created instance of bootable Manjaro.
Thanks for clarification!

6

An interesting Youtube clip. Its not Manjaro of course but it is Linux:

7

I was referring specifically to the tool / package named extundelete

8

What are you talking about? You don’t have anything mounted when you boot live usb.

Again, what? Did you try installing anything? It installs it in ram.

9

Well, you would of course want to boot on the USB operating system, which would in turn allow you to unmount /home, then use extundelete or at least as has been related online, the better command ext4magic. As they require /home to be unmounted to work at all.
But when booting on a live USB instance of Manjaro, those tools are not included nor is it possible to install them. That’s where I’m at now.

10

And I’m telling you you are wrong on all counts. :stuck_out_tongue:

  • You don’t have your /home mounted at all. (or any other partition from your disks)
  • You can install whatever you want.
1 Like
11

I’ve tried, and I’m not able to install anything off the Manjaro bootable USB.
Namely, those two undelete commands. How is it done?

12

Same as you would on your system. Update everything and install whatever package you want - testdisk probably. Don’t know what all of you are dreaming about undelete…

13

I’m not dreaming anything about it, I haven’t even been able to install it lol

If I execute:

$ sudo pacman -Sy

I get:

:: Synchronizing package databases…
error: failed retrieving file ‘core.db’ from XXXXXXX : Could not resolve host: XXXXX
about 200 lines of different site names.

Then if I try:

$ sudo pacman - Sy ext4magic

I get:
error: failed retrieving file ‘core.db’ from XXXXXXX : Could not resolve host: XXXXX
about 200 lines of different site names again.
Followed by ‘extra.db’, ‘community.db’, ‘multilib.db’. I can’t copy and paste because its a different computer but its running a live instance of Manjaro off USB right now.

14

-Sy isn’t updating your system. I wonder where are you getting these commands from…
Anyway, first you need to have internet access. And then update mirrors, ie. select some close to you.

EDIT:

If internet is working you can append this to any command and then just show us link you get:

<command> |& tee >(curl -F 'f:1=<-' ix.io)
15

sudo pacman-mirrors --fasttrack 5 && sudo pacman -Syy
sudo pacman -S ext4magic

16

Hang on I think I’ve been assuming the live USB instance was not writeable but maybe it is(??!) I thought it was read only. It looks like I had a connection problem on top of everything.
I can’t copy and paste anything between so this is a bit of a pita. I think I have it installed but not that way. Uch

So straight up, lets say you have a directory /home/FILES which got deleted, and you have ext4magic installed on your live USB instance.
Assumedly /home on the actual PC is already not mounted right.
So you can run GParted on your live USB instance, and find the /home filesystem on the hard drive. Which in this case is /dev/sda7 I believe.

Can you just use a command line with ext4magic to try and restore the directory, just pointing to the unmounted filesystem, like you would with extundelete?

17

Do you even read what I’m writing you?

1 Like
18

Do you ever read what I’m writing you? >>>

I’ve got 20 windows open with online explanations and 2 computers, and I’m also trying things at the same time. Sorry if my brain is not as fast as it used to be (or ever was, lol)

19

No idea how ext4magic works. You’ll have to check their documentation. Last thing I’ve used was testdisk and it was pretty simple to recover some files. You just select which partition it scans, then you select which files or folders you want to recover and then you select where you want to save them (should be different partition).

20

I am completely unfamiliar with testdisk. Is this GUI based? Can that just be loaded via command line. All I saw was everybody online saying extundelete sucks because it hasn’t been updated in a long time and to use ext4magic. But I haven’t even tried that yet I just got it loaded