Ubuntu

How to recover a data from /tmp

Asked by FUAD ABDULLA

My server (3.19.0-25-generic) is in production state. I recently did a security patch update and did a server reboot. However, there were a few important files placed in /tmp which got deleted post reboot.
Is there any way to recover the lost data ? Below is my filesystem structure. /tmp is not mounted as a filesystem; however, it is just a directory on /. Please assist.

Is there anyway to recover data atleast from lost+found present on / mount point?

Filesystem Size Used Avail Use% Mounted on
/dev/mapper/MEDNETFILESRV1--vg-root 685G 415G 241G 64% /
none 4.0K 0 4.0K 0% /sys/fs/cgroup
udev 2.0G 4.0K 2.0G 1% /dev
tmpfs 396M 716K 395M 1% /run
none 5.0M 0 5.0M 0% /run/lock
none 2.0G 8.0K 2.0G 1% /run/shm
none 100M 0 100M 0% /run/user
/dev/sda1 236M 38M 186M 17% /boot

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
actionparsnip (andrew-woodhead666) said : 		#1

/tmp is a tempfs. It lives in RAM. If you have ran a backup and don't have the folder as an exception then restore from those.

Revision history for this message
Manfred Hampl (m-hampl) said : 		#2

Several remarks:

1. See https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard
/tmp is meant for temporary storage, and usually everything located there is deleted when rebooting. There should never "a few important files" be stored there. If you do not have backup copies of these files, then they are not recoverably with standard actions any more.

2. There are some tools available to recover lost files (photorec, testdisk, scalpel, foremost, ...).
See e.g. https://help.ubuntu.com/community/DataRecovery or https://ubuntu-mate.community/t/recovering-deleted-files-and-folders/2211 or similar web pages.

3. /lost+found is a special directory. If during execution of the file system check command there are files identified that are not located in any other directory, then the file system check creates a directory in try for that file in /lost-found. This has nothing to do with file deletion.

4. The kernel version 3.19.0-25-generic seems very outdated to me (from August 2015). I assume that you are missing several security enhancements and bug fixes. Which Ubuntu release are you running?

Revision history for this message
Manfred Hampl (m-hampl) said : 		#3

oops, wrong autocorrection

in 3. ... the file system check creates a directory entry for that file in /lost-found. ...

Can you help with this problem?

Provide an answer of your own, or ask FUAD ABDULLA for more information if necessary.

To post a message you must log in.