recover delete folder

Asked by Luis M.Jacinto

Ubuntu 12.04

I have two HDD (A) and (B), both with Ubuntu 12.04, while working with booted (B) drive by mistake delete .thunderbird folder from home folder on (A) drive.
Search on line advised I should use Extundelete app. download extundelete-0-2-4.tar.bz2.
Reading the documentation I find quiet difficult to follow.
Can you please help me to recover this folder.
Thank you

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Solved by:
Manfred Hampl
Solved:
Last query:
Last reply:
Revision history for this message
actionparsnip (andrew-woodhead666) said :
#1

Use your backups is by far the easiest way....

Revision history for this message
Manfred Hampl (m-hampl) said :
#2

How did you delete the folder?
If you did this with programs like nautilus, then it will most probably be available in the recycle bin (trash folder).

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#3

From (B) drive and looking into (A) drive home folder with cursor on the .thunderbird I press keyboard Delete, look on Trash folder of (A) drive and is not there.

Revision history for this message
Manfred Hampl (m-hampl) said :
#4

what is the output of
df -h

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#5

Sorry didn’t told you but Ubuntu on my main disk (A) drive is not bootable, it has a big error which later I will ask for help, I can’t “df -h” on the (A) drive.
I apologise for the mistake my main concern is to recover the directory and not to rewrite anything
on the disk, is it possible?.
Thank you

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#6

As “df -h” command gives the total disk space available, I connect the (A) drive and checked with Properties and surprise gave me 248.7 GB used and 0 bytes free, disk is 250 GB.
Don’t know how the disk got full the last time checked still had a good amount.

Revision history for this message
Manfred Hampl (m-hampl) said :
#7

I am a bit lost with the setup of your disks. Please explain.

From which disk partition do you normally boot?
From which disk partition did you boot, when you deleted the directory?
On which disk partition was that deleted directory?
With the a disk connected, what is the output of

sudo fdisk -l
df -h

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#8

From which disk partition do you normally boot? (A) main disk is the working disk
From which disk partition did you boot, when you deleted the directory? (B) disk.
Two HDD connected on bios, Booted with (B) disk on the main page shows the (A) drive I went to (A) home then put the cursor on .Thunderbird directory and press Delete.
On which disk partition was that deleted directory? I am not 100% sure on this, but I think a normal Ubuntu installation the partition will be /dev/sda1 ext4.
With the a disk connected, what is the output of
sudo fdisk -l
df -h
I need help on this one, the (A) drive also as a problem and can't boot and is total full, how to do this with the drive not booted.

Revision history for this message
Manfred Hampl (m-hampl) said :
#9

What output do you get for

sudo fdisk -l
df -h

when booted from the (B) disk?

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#10

luis@luis-G41M-Combo:~$ sudo fdisk -l
[sudo] password for luis:

Disk /dev/sda: 250.1 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000b6594

   Device Boot Start End Blocks Id System
/dev/sda1 * 2048 484276223 242137088 83 Linux
/dev/sda2 484278270 488396799 2059265 5 Extended
/dev/sda5 484278272 488396799 2059264 82 Linux swap / Solaris
luis@luis-G41M-Combo:~$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 231G 6,4G 213G 3% /
udev 983M 4,0K 983M 1% /dev
tmpfs 396M 828K 395M 1% /run
none 5,0M 0 5,0M 0% /run/lock
none 990M 80K 990M 1% /run/shm
luis@luis-G41M-Combo:~$

Revision history for this message
Manfred Hampl (m-hampl) said :
#11

There is only one disk (/dev/sda) shown. What "(B)" disk are you always referring to?

How do you switch between "disk (A) and disk (B)" when booting?

What is the output of the commands

sudo ls -la /
sudo ls -la /.Trash
sudo ls -la /.Trash-1000
ls -la ~/.local/share/Trash

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#12

There is some confusion with disks, disk (A) is my main disk is inside of the PC.
Disk (B) we can call a spare disk or external disk.
When enter the terminal sudo fdisk -l command the first time I was working with booted (B) disk only, the (A) disk was not connect that’s why it show only one disk .
Connect both disks and enter the command again the result followers.
luis@luis-G41M-Combo:~$ sudo fdisk -l
[sudo] password for luis:

Disk /dev/sda: 250.1 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000b6594

   Device Boot Start End Blocks Id System
/dev/sda1 * 2048 484276223 242137088 83 Linux
/dev/sda2 484278270 488396799 2059265 5 Extended
/dev/sda5 484278272 488396799 2059264 82 Linux swap / Solaris

Disk /dev/sdb: 250.1 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000c931d

   Device Boot Start End Blocks Id System
/dev/sdb1 * 2048 486373375 243185664 83 Linux
/dev/sdb2 486375422 488396799 1010689 5 Extended
/dev/sdb5 486375424 488396799 1010688 82 Linux swap / Solaris
luis@luis-G41M-Combo:~$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 231G 6,4G 213G 3% /
udev 983M 4,0K 983M 1% /dev
tmpfs 396M 848K 395M 1% /run
none 5,0M 0 5,0M 0% /run/lock
none 990M 80K 990M 1% /run/shm
/dev/sdb1 232G 231G 0 100% /media/feeb7ae5-1ada-4933-a640-bb0d40ee4e2a
luis@luis-G41M-Combo:~$

Revision history for this message
Manfred Hampl (m-hampl) said :
#13

Ok, now please provide the output of

sudo ls -la /
sudo ls -la /.Trash
sudo ls -la /.Trash-1000
ls -la ~/.local/share/Trash
sudo ls -la /media/feeb7ae5-1ada-4933-a640-bb0d40ee4e2a
sudo ls -la /media/feeb7ae5-1ada-4933-a640-bb0d40ee4e2a/.Trash
sudo ls -la /media/feeb7ae5-1ada-4933-a640-bb0d40ee4e2a/.Trash-1000

(Some of the commands might end with 'no such file or directory', this is ok.)

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#14

luis@luis-G41M-Combo:~$ sudo ls -la /
[sudo] password for luis:
total 96
drwxr-xr-x 23 root root 4096 May 23 07:45 .
drwxr-xr-x 23 root root 4096 May 23 07:45 ..
drwxr-xr-x 2 root root 4096 May 23 07:46 bin
drwxr-xr-x 3 root root 4096 May 23 07:47 boot
drwxr-xr-x 2 root root 4096 May 23 07:28 cdrom
drwxr-xr-x 16 root root 4260 May 24 15:58 dev
drwxr-xr-x 127 root root 12288 May 24 15:58 etc
drwxr-xr-x 3 root root 4096 May 23 07:31 home
lrwxrwxrwx 1 root root 36 May 23 07:45 initrd.img -> boot/initrd.img-3.2.0-23-generic-pae
drwxr-xr-x 21 root root 4096 May 23 07:46 lib
drwx------ 2 root root 16384 May 23 07:21 lost+found
drwxr-xr-x 3 root root 4096 May 24 15:58 media
drwxr-xr-x 2 root root 4096 Apr 19 2012 mnt
drwxr-xr-x 2 root root 4096 Apr 23 2012 opt
dr-xr-xr-x 159 root root 0 May 24 15:30 proc
drwx------ 5 root root 4096 May 23 09:34 root
drwxr-xr-x 20 root root 740 May 24 15:30 run
drwxr-xr-x 2 root root 4096 May 23 07:47 sbin
drwxr-xr-x 2 root root 4096 Mar 5 2012 selinux
drwxr-xr-x 2 root root 4096 Apr 23 2012 srv
drwxr-xr-x 13 root root 0 May 24 15:30 sys
drwxrwxrwt 9 root root 4096 May 24 16:17 tmp
drwxr-xr-x 10 root root 4096 Apr 23 2012 usr
drwxr-xr-x 13 root root 4096 May 24 15:26 var
lrwxrwxrwx 1 root root 33 May 23 07:45 vmlinuz -> boot/vmlinuz-3.2.0-23-generic-pae
luis@luis-G41M-Combo:~$ sudo ls -la /.Trash
ls: cannot access /.Trash: No such file or directory
luis@luis-G41M-Combo:~$ sudo ls -la /.Trash-1000
ls: cannot access /.Trash-1000: No such file or directory
luis@luis-G41M-Combo:~$ ls -la ~/.local/share/Trash
ls: cannot access /home/luis/.local/share/Trash: No such file or directory
luis@luis-G41M-Combo:~$ sudo ls -la /media/feeb7ae5-1ada-4933-a640-bb0d40ee4e2a
total 168
drwxr-xr-x 24 root root 4096 Mar 17 06:52 .
drwxr-xr-x 3 root root 4096 May 24 15:58 ..
drwxr-xr-x 2 root root 4096 Feb 25 08:55 bin
drwxr-xr-x 3 root root 16384 Mar 17 06:54 boot
drwxr-xr-x 5 root root 4096 Apr 23 2012 dev
drwxr-xr-x 164 root root 12288 May 16 07:41 etc
drwxr-xr-x 4 root root 4096 Oct 31 2014 home
lrwxrwxrwx 1 root root 38 Mar 17 06:52 initrd.img -> /boot/initrd.img-3.2.0-101-generic-pae
lrwxrwxrwx 1 root root 37 Feb 25 08:56 initrd.img.old -> /boot/initrd.img-3.2.0-99-generic-pae
-r-xr-xr-x 1 root root 1775 Sep 19 2012 install.sh
drwxr-xr-x 23 root root 4096 Feb 17 09:06 lib
lrwxrwxrwx 1 root root 34 Feb 27 14:43 libnss3.so -> /usr/lib/i386-linux-gnu/libnss3.so
drwx------ 2 root root 16384 Jul 1 2012 lost+found
drwxr-xr-x 7 root root 4096 May 12 14:37 media
drwxr-xr-x 3 root root 4096 Nov 11 2014 mnt
drwxr-xr-x 7 root root 4096 Apr 23 08:47 opt
drwxr-xr-x 2 root root 4096 Apr 19 2012 proc
drwx------ 18 root root 4096 May 11 10:05 root
drwxr-xr-x 2 root root 4096 Sep 15 2012 .rpmdb
drwxr-xr-x 8 root root 4096 Apr 23 2012 run
drwxr-xr-x 2 root root 12288 May 3 08:40 sbin
drwxr-xr-x 2 root root 4096 Mar 5 2012 selinux
drwxr-xr-x 2 root root 4096 Apr 23 2012 srv
drwxrwxr-x 3 root root 4096 Jan 22 2013 striata-reader
drwxr-xr-x 2 root root 4096 Apr 14 2012 sys
drwxrwxrwt 2 root root 24576 May 15 11:24 tmp
-r-xr-xr-x 1 root root 1065 Sep 19 2012 uninstall.sh
drwxr-xr-x 10 root root 4096 Apr 23 2012 usr
drwxr-xr-x 14 root root 4096 May 16 07:41 var
lrwxrwxrwx 1 root root 34 Mar 17 06:52 vmlinuz -> boot/vmlinuz-3.2.0-101-generic-pae
lrwxrwxrwx 1 root root 33 Feb 25 08:56 vmlinuz.old -> boot/vmlinuz-3.2.0-99-generic-pae
luis@luis-G41M-Combo:~$ sudo ls -la /media/feeb7ae5-1ada-4933-a640-bb0d40ee4e2a/.Trash
ls: cannot access /media/feeb7ae5-1ada-4933-a640-bb0d40ee4e2a/.Trash: No such file or directory
luis@luis-G41M-Combo:~$ sudo ls -la /media/feeb7ae5-1ada-4933-a640-bb0d40ee4e2a/.Trash-1000
ls: cannot access /media/feeb7ae5-1ada-4933-a640-bb0d40ee4e2a/.Trash-1000: No such file or directory
luis@luis-G41M-Combo:~$

Revision history for this message
Manfred Hampl (m-hampl) said :
#15

Sorry to say, but the commands did not show a trash folder anywhere. I do not see the possibility to recover the deleted folder from a wastebasket.

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#16

Is there a possibility the directory still in the disk and Extundelete app recover it?

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#17

You could try foremost. You will need a writable partition of equal or greater capacity than the partition you are recovering. You will lose filename and folder location but the files may be recoverable. You will "recover" the standing files too. If the area where the data stood has been overwritten with new data then the files are completely irretrievable.

Why do you not have a regular backup? A 1Tb USB drive costs nothing and helps preserve data. Making it quick and easy to restore. Is your data that disposable to you?

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#18

You could try foremost. You will need a writable partition of equal or greater capacity than the partition you are recovering. You will lose filename and folder location but the files may be recoverable. You will "recover" the standing files too. If the area where the data stood has been overwritten with new data then the files are completely irretrievable.

Why do you not have a regular backup? A 1Tb USB drive costs nothing and helps preserve data. Making it quick and easy to restore. Is your data that disposable to you?

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#19

You so right about backup.
Didn’t work with the disk since deleted the directory.
You will need a writable partition of equal or greater capacity than the partition you are recovering.
Don’t understand this, the disk is a 250 GB, partition is on ext4 and about 230 GB how big
 this partition have to be?.
I want to save most important data, I thought of copying the data to another disk with Ubuntu 12.04
to continue with daily work, and delete the data from the full disk to recover some space, will this action will overwrite anything
into the disk?
Just found this application “Ubuntu-rescue-remix” can it recover my folder and can you help to work with it?.
Thankyou

Revision history for this message
Manfred Hampl (m-hampl) said :
#20

First you have to be sure about the disk partition where the file(s) were, that you want to recover.
There was some confusion with your usage of "disk (A)" and "disk (B)", that in Unix terms were /dev/sda and /dev/sdb, but not necessarily with "disk (A)" being /dev/sda etc.

Ubuntu-rescue-remix is a live system containing (among others) foremost. You could try using it.

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#21

ith Live CD and Gparted checked main disk (A) for partitions, find this, which partition should be searched for the deleted directory when it was on home folder?
/dev/sda1 – File system = ext4, Size = 281.92 GiB, used = 230.74 GiB, unused = 1.18 GiB, Flags = boot.
/dev/sda2 - File system = extended, Size = 987.00 MiB, used = - , unused = - , Flags = .

/dev/sda5 - File system = linux swap, Size = 987.00 MiB, used = - , unused = - , Flags = .
One more question please.
I want to save most important data, I thought of copying the data to another disk with Ubuntu 12.04
to continue with daily work, and delete the data from the full disk to recover some space, will this action will overwrite anything into the disk?
Thank you for the great help.

Revision history for this message
Best Manfred Hampl (m-hampl) said :
#22

The only data partition on that disk is sda1.
sda2 is an extended partition (more or less just a container for other partitions, without own data),
sda5 is the swap partition (also without data, just used for temporary storage of data that do not fit into memory).

If you just read data from that disk/partition, nothing will be overwritten.

Revision history for this message
Luis M.Jacinto (ljacinto) said :
#23

Thanks Manfred Hampl, that solved my question.