Disappearing files from computer

Asked by davidzaq1

Hello,

I had a problem a few days ago. I have posted the problem but no one seemed to have an answer how to fix it.

I am not even sure what happened but now have a new question.

A few days ago my system did an update. That night, I wanted to get some photos off my phone and put them on the computer so I could have more space on my phone.

After uploading the photos, I turned off the computer. The next day when I turned on the computer I could not access the admin side of the computer. I could use the computer as a guest but on the admin side, there was no terminal, I could not get to any files,, folders, unity or anything.

I tried switching back to an older kernel as I thought this might be the problem. I was not able to get any of that working.

Today, strangely enough, I tuned on the computer and could access the admin side of the computer and all my files and folders. Somehow it just came back.

But even stranger, was that there was nothing in my files and folders. Everything was gone.
All the software from the software center I installed were on the computer but everything else was gone.

First question, Did my computer get hacked from uploading toe photos from my phone?

Second, If my computer did not get bombed, is it possible that going from a new kernel back to an old one wiped out the files on the computer?

Third, if my computer was attacked, is there a way to track this or find out?

Fourth, Is there a way these files and folders are still on the computer and would it be possible to bring them back out?

I hope you can help me with this.

Thank you,

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Solved by:
davidzaq1
Solved:
Last query:
Last reply:

This question was reopened

Revision history for this message
Manfred Hampl (m-hampl) said :
#1

To verify whether the files are still there on your computer you probably best start the system in recovery mode - root command prompt and then search for the file(s).

To cope with your problem that the desktop is incomplete when logged in with your normal username, but it is working with a guest login, I suggest that you try creating a new administrative user:

log in with your normal user ID (to the broken desktop)
switch to a virtual console (by pressing ctrl-alt-F1)
log in with your username and password
issue the commands

sudo adduser testuser
sudo passwd testuser
sudo usermod -aG admin testuser

reboot and log in as testuser
Do you have a complete desktop when logged in as testuser?

Revision history for this message
davidzaq1 (david3a9x) said :
#2

right now, everything is working fine.
I have no problems logging in on admin side.

The only problems I have is all my files and photos disappeared.
I wanted to find out if they are still on the hard drive and if they
are, if they can be recovered.

You mentioned something in the first part of your post but I am not a great computer user and still learning so I am not sure what you are talking about, starting the computer and the root command and all that.

Can you give me a more step-by-step model on how to do this?
I cannot afford to have this crash on me.

Thank you

Revision history for this message
Manfred Hampl (m-hampl) said :
#3

Can you log in normally with your normal username and you get a full desktop again?

Do you remember the names of the files that have disappeared and the directories where they were stored?

There is some kind of 'inventory' function in Ubuntu.

Open a terminal window and issue the command

sudo updatedb

And then you can search for files with the locate command.
E.g. if you have a song "Michael Jackson - Thriller.mp3" you can search for it with the command

locate -i jackson

(In fact this command will display the path and file name of any file with the name containing jackson or Jackson or JACKSON etc.)

Revision history for this message
davidzaq1 (david3a9x) said :
#4

Yes, I can log into computer normally and get to desktop.

Everything disappeared.

Under downloads, everything in the download folder disappeared.
Under Photos, All photos disappeared.
Under Music, All music disappeared.

Same with documents.

I only remember the names of the files but not directories unless you mean
downloads, music and photos are the names of the directories.

I tried the command above.

it brought up files but nothing related to what I was looking for.

As an example:

I ran the command and put in:

-i MacArthur as I had a folder with that name.

It ran a bunch of things in the terminal and here is the last part of the output:

/usr/src/linux-headers-4.4.0-36-generic/include/config/snd/soc/intel/broadwell/mach.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/snd/soc/intel/byt/max98090/mach.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/snd/soc/intel/byt/rt5640/mach.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/snd/soc/intel/bytcr/rt5640/mach.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/snd/soc/intel/cht/bsw/max98090/ti/mach.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/snd/soc/intel/cht/bsw/rt5645/mach.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/snd/soc/intel/cht/bsw/rt5672/mach.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/snd/soc/intel/haswell/mach.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/snd/soc/intel/skl/rt286/mach.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/stmmac/eth.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/stmmac/platform.h
/usr/src/linux-headers-4.4.0-36-generic/include/config/x86/numachip.h
/var/cache/apt/archives/xserver-xorg-video-mach64-lts-xenial_6.9.5-1build2~trusty1_amd64.deb
/var/cache/dictionaries-common/emacsen-ispell-default.el
/var/cache/dictionaries-common/emacsen-ispell-dicts.el
/var/lib/dbus/machine-id
/var/lib/dpkg/info/fonts-tibetan-machine.list
/var/lib/dpkg/info/fonts-tibetan-machine.md5sums
/var/lib/dpkg/info/fonts-tibetan-machine.preinst
/var/lib/dpkg/info/libdigest-hmac-perl.list
/var/lib/dpkg/info/libdigest-hmac-perl.md5sums
/var/lib/dpkg/info/xserver-xorg-video-mach64-lts-xenial.list
/var/lib/dpkg/info/xserver-xorg-video-mach64-lts-xenial.md5sums
/var/lib/dpkg.backup/info/fonts-tibetan-machine.list
/var/lib/dpkg.backup/info/fonts-tibetan-machine.md5sums
/var/lib/dpkg.backup/info/fonts-tibetan-machine.preinst
/var/lib/dpkg.backup/info/libdigest-hmac-perl.list
/var/lib/dpkg.backup/info/libdigest-hmac-perl.md5sums
/var/lib/dpkg.backup/info/xserver-xorg-video-mach64-lts-wily.list
/var/lib/dpkg.backup/info/xserver-xorg-video-mach64-lts-wily.md5sums
/var/lib/ghostscript/CMap/Adobe-CNS1-H-Mac
/var/lib/ghostscript/CMap/Adobe-GB1-H-Mac
/var/lib/ghostscript/CMap/Adobe-Japan1-H-Mac
/var/lib/ghostscript/CMap/Adobe-Korea1-H-Mac

But as you can see there is no file named MacArthur in there.
There was a huge list of things in the terminal but most of it is like the above lists.

Even if there was a file I was looking for in the terminal, how would I get it out of there and back into my folders?

I hope you can help me with this.

Thank you.

Revision history for this message
Manfred Hampl (m-hampl) said :
#5

Did you store the files when logged in with your normal username, or when logged in a guest (due to startup problems)?
Whatever you do as guest will be gone after logging out.

What is the output of the commands

ls -la /home
find .local/share/Trash/ -ls

Revision history for this message
davidzaq1 (david3a9x) said :
#6

When I was logged in with my normal username, I stored the files.
Under guest login, I only used this to access internet. I did not create any files.

Here is the output from the two commands.
I dump the trash on a daily basis so there will not be anything in there.

Thank you

:~$ ls -la /home
total 12
drwxr-xr-x 3 root root 4096 May 9 12:20 .
drwxr-xr-x 23 root root 4096 Aug 16 13:38 ..
drwxr-xr-x 23 stan stan 4096 Aug 26 09:31 stan

$ find .local/share/Trash/ -ls
6424518 4 drwx------ 5 stan stan 4096 Aug 26 09:52 .local/share/Trash/
6424546 4 drwx------ 2 stan stan 4096 Aug 26 09:52 .local/share/Trash/files
6424137 4 drwx------ 2 stan stan 4096 Aug 26 09:52 .local/share/Trash/expunged
6424545 4 drwx------ 2 stan stan 4096 Aug 26 09:52 .local/share/Trash/info

Revision history for this message
Manfred Hampl (m-hampl) said :
#7

In that case I assume that you inadvertently deleted the files (i.e. moved them to the trash bin) and then you have purged them by emptying the trash.

You might try recovering some of the files from the hard disk (e.g. with foremost, scalpel or photorec), see https://help.ubuntu.com/community/DataRecovery

Revision history for this message
davidzaq1 (david3a9x) said :
#8

I did not move any files to the trash. It would be impossible.
I would have had to open ever tab and delete each file by hand.
Also, all my apps were taken off the unity tab on the left side of the computer.

There is no way I could have move all those things to the trash.
Besides that, I always check the trash to make sure there is not something there that I needed before emptying it.

As for this line, https://help.ubuntu.com/community/DataRecovery

I have been there and do not understand what they are talking about and how to get the files off the hard drive.

Dan you give me a more simple, step-by-step instructions?

Thank you

Revision history for this message
Manfred Hampl (m-hampl) said :
#9

A general remark: Files do not disappear from themselves.

I see several possibilities:
1. The files are stell there, but you do not find them
2. The files are on a different device
3. The files have really been deleted.
Do you have different hard disk partitions or are you using additional hard disks?

If you use the delete function for a file inside the file explorer program, then the file is not immediately deleted but only moved to the trash bin; but you tell that you for sure have not done this. You have to be aware that deleting a file with the rm command from a terminal window does not move it to the trash bin first, but does an immediate deletion.
Did you play around with commands like rm -rf ?

Revision history for this message
davidzaq1 (david3a9x) said :
#10

Well, first, I can tell you that there is no different device.

Yes, it is possible the files are here but I do not see them but if they are here, they must be on
the hard drive because they are no where I can get to on the computer.

I have no additional hard disk partitions and no additional hard disks.

If the files have really been deleted, I did not do it knowingly. I am very careful not to delete things as I need everything I put on this computer.

That only leaves the option that I must have deleted them by mistake without using the delete key.

The only thing I can tell you for sure is that I put a micro SD card from my phone into an adapter and downloaded my photos from my phone onto the computer. Then there was a software update that I completed. I turned off the computer. I forgot I needed to do something and immediately turned on the computer and everything was gone.
I had no unity desktop, no icons, nothing. I could not even access the terminal.

The only thing I could do was get to terminal through cntrl+Alt+F1 and access the guest side of the computer.

Someone said the problem may be with the Kernel and to switch back to a previous version.
I seem to remember something about an "rm" command but I am not sure.

If I did use this command are the files gone or still on the hard drive? If so, can I still get to them?

Thank you.

Revision history for this message
Manfred Hampl (m-hampl) said :
#11

I assume that the files have been deleted.
The best way to get them back is from your backups. I hope that you have created backups if the files are important for you.
Or you can try using some of the data recovery programs to restore deleted files.

Revision history for this message
davidzaq1 (david3a9x) said :
#12

This was not very helpful.

I am sure the files are on the harddisk somewhere.

There must be a way to search the hard drive

Revision history for this message
Manfred Hampl (m-hampl) said :
#13

If the files were still on the hard disk, then the search commands that you have already done (e.g. locate ...) would have found them.

Revision history for this message
davidzaq1 (david3a9x) said :
#14

I am going to assume the files are gone since I cannot find a program to search for the files. There are some programs out there but the instructions are so complicated, I cannot figure out what to do with them.

Thank you

Revision history for this message
davidzaq1 (david3a9x) said :
#15

I am going to assume the files are gone since I cannot find a program to search for the files. There are some programs out there but the instructions are so complicated, I cannot figure out what to do with them.

Thank you

Revision history for this message
davidzaq1 (david3a9x) said :
#16

I am going to try changing over to the new 16.04.

Revision history for this message
davidzaq1 (david3a9x) said :
#17

This problem is solved.

Thank you.