accidentally deleted a file folder on the desktop

Asked by John Osborne

Accidentally deleted 2-3 file folders by clicking on the folders and hitting "delete." The folder contained hundreds of png and jpeg files. Looked in trash - but nothing has shown up. Where did these folders go? Can the folder or the image files contained therein be recovered? Have not backed up lately - so that option is - out!

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu nautilus Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Eliah Kagan (degeneracypressure) said :
#1

If you just selected them and pressed the Delete key, they should be in the trash. Is it possible that you've emptied the trash since then?

Let's search for it. Please open a Terminal window (Ctrl+Alt+T or Applications > Accessories > Terminal) and run the following command by copying it to the clipboard, pasting it in the Terminal, and pressing enter:

ls -Rl $(find ~ -iname trash)

Then select all the text in the Terminal (Edit > Select All), copy it to the clipboard (Edit > Copy), and paste it here.

Revision history for this message
John Osborne (josborne) said :
#2

Thanks Eliah, did not empty the trash as its still sitting there, but without the recent deletions. The deleted file was a folder, as oppose to document.

Just ran the output - but am little concerned about pasting it here - in public - is there another way, can we talk on skype or remote into my pc?

Revision history for this message
John Osborne (josborne) said :
#3

Confirm that the folders (do not) show up in trash,
However, in Nautilus, the deleted folders do show up in "History," so there is a historical record of them.

Revision history for this message
John Osborne (josborne) said :
#4

FYI: the script did not return any trash dated after 2009,

Revision history for this message
Eliah Kagan (degeneracypressure) said :
#5

If none of the folders or files that you deleted are shown in the list of files that is outputted from that command, but other trash items are shown (indicating that the command worked properly), then I think it's not necessary for you to show me the output at all. Otherwise, if you do need to show it to me, perhaps you could censor it by changing the names of files, making sure to remove any confidential or otherwise sensitive information.

It is expected that they would appear in your history, even if they have been "permanently" deleted.

This is rather strange. Perhaps the documents got moved somewhere else on your system--you could search for them. I'd suggest using the built-in search functionality of Nautilus to do this (Places > Search for Files...). You may also want to browse through your home folder and its subfolders and look for them. I don't know what else to tell you.

If you cannot find the files that way and it is extremely important that they be recovered, then you should know that it is sometimes possible to recover deleted files...but difficult, and the files are sometimes damaged or otherwise only partially recovered. If it's critical that you recover them, then you should do nothing more with the computer (shut it down if you absolutely have to--otherwise, just leave it be) and hire a data recovery expert, which will be expensive but will maximize your chances of success. If it is less important than it be recovered and you want to try to recover them, then I can try to help you with that. Generally speaking, I recommend restoring from backups in this kind of situation...but since you don't have them, that's not an option. It's likely that re-creating or re-obtaining the files is the best, fastest, and easiest solution, if you cannot find them.

However, if you are absolutely certain that all you did to the files was to select them (or select their containing folders) and press Delete, and that the Trash has not been emptied since, then they surely should not have been permanently deleted, and we could investigate that further.

Revision history for this message
Eliah Kagan (degeneracypressure) said :
#6

"FYI: the script did not return any trash dated after 2009,"

Are there items currently shown to be in the trash (when you look in the trash, in the normal way, by clicking the trash icon on the bottom panel)? Are any of those items from after 2009?

Revision history for this message
John Osborne (josborne) said :
#7

Eliah;

Thanks for your considered response.
Here are my answers:
(1) Files represent few years of activity, cannot be recreated and must be recovered
(2) Confirm that "Trash" does not show the files in question - trash does show activity and even a few deleted files from earlier today but not the files in question.
(3) Terminal resultant does not show the folders either (nor deleted files after 2009?)
(4) Performed a location search (versus a file search) from Nautilus using the names of the files but resultant was negative.
(6) Confirm to you that the folders were selected (from the DESKTOP) and then deleted by hitting the delete button - that's it! And agree with you that in theory these folders should be simple to spot, either in trash
or from search or terminal.

What do you recommend next?

Revision history for this message
Eliah Kagan (degeneracypressure) said :
#8

"Files represent few years of activity, cannot be recreated and must be recovered"

That is unfortunate. It sounds from what you're saying that the value of the lost files is at least around a thousand US dollars (and perhaps much, much more), which I think indicates that professional assistance, including (and primarily) professional data recovery, would be a good choice.

There is one thing that I'd suggest trying first--search the entire filesystem, as root, for keywords from the folders' and files' filenames. This will look something like

sudo find / -iname part-of-filename

where part-of-filename is the part of the filename. I'd do this for each of the files and folders you're looking for. If you can put in the whole file or folder name, that's even better, because it will narrow down non-useful matches. If you use -name instead of -iname then it's case-sensitive. See http://manpages.ubuntu.com/manpages/maverick/en/man1/find.1.html (if you're running Ubuntu 10.10) or http://manpages.ubuntu.com/manpages/lucid/en/man1/find.1.html (if you're running Ubuntu 10.04) for details.

It's worth trying that, I think, but I wouldn't get your hopes up--it's not particularly likely to turn up anything not revealed by searching in Nautilus.

There aren't currently any data recovery businesses that I can vouch for (which is because of my own ignorance, not a lack of good professionals in that field). What I would do, in a situation where I had to recover deleted files under complicated circumstances such as this, would be first to consider paid support for Ubuntu from Canonical (and to purchase it, if the price is acceptable). I believe that you can get information about that at http://www.ubuntu.com/business/services/overview. It's possible that they may be aware of the specifics of this unusual situation, and know of a simple solution. They may also be able to provide data recovery services. But more likely than either of those possibilities, I think, is that they could refer you to good providers of data recovery services. Before paying Canonical, you may want to research data recovery services yourself, so that you can choose between various options.

You should not use the affected machine for anything but working on this problem. In fact, you shouldn't use it for continuing this conversation on Launchpad. Continuing to use it can cause the data associated with deleted files to be overwritten (or to be overwritten even more than it already is, as the case might unfortunately be). It is, generally speaking, OK to boot from a system installed on a separate physical disk, such as a live CD system, on that machine, in order to use that machine while minimizing or eliminating the risk of overwriting the data that needs to be recovered. I am not sure if it's preferable to shut down the machine, or to keep it running but not do anything with it, while you're waiting for data recovery operations to be performed.

If you decide not to go for professional assistance, then I can attempt to show you how to perform data recovery, but I would emphasize that (1) if I were standing to lose thousands of dollars of assets, I would personally pay for professional assistance, and (2) depending on how difficult the recovery is and how much you're willing to pay, data recovery experts can dump your drive, or even disassemble and examine it, in order to recover the most data possible. If you try a do-it-yourself approach and it fails, you can still hire professional help later, but it is possible that the operations you perform to attempt to recover data might have the effect of causing additional data loss (among the already deleted files--not in files that are currently accessible). Please note also that I am *not* and professional, *not* a data recovery expert, and that neither I nor anyone else here on Launchpad.net can take responsibility for any lack of success, or even additional damage, caused by following our advice.

Finally--and this is an option that you can choose in conjunction with any of the others--you might choose to leave this question open, so that perhaps someone else who has experienced or is familiar with your situation (of files being "permanently" deleted instead of going to the Trash) can weigh in with additional potentially useful information.

Revision history for this message
BabyGeek (babygeek) said :
#9

Something similar happened to me yesterday.
I used testdisk and foremost.

This page is very useful : https://help.ubuntu.com/community/DataRecovery

Revision history for this message
Sam_ (and-sam) said :
#10

> Have not backed up lately

Then I'd boot from LiveCD since any attempt now may overwrite those files on hard drive.
You may restore files via testdisk.
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

In particular Photorec helps restoring images.
https://help.ubuntu.com/community/DataRecovery#Photorec

Prevention.
https://help.ubuntu.com/community/BackupYourSystem

Revision history for this message
John Osborne (josborne) said :
#11

Have IT contractor coming in today or tomorrow and will share these posts with him and see how far we can get. Appreciate your thoughtful responses and will keep this post - updated.

Revision history for this message
John Osborne (josborne) said :
#12

One issues about this situation concerns me; the apparent lack of contingency within Ubuntu for recovering a deleted file - other than trash. What if a deleted file cannot be found in trash. Babygeek had a similar issue and is it possible that thousands of others have experienced the same? From what I can determine at this time, it appears that if trash doesn't show the deleted file that Ubuntu offers no further option (contingency methods) for recovering it? (Of course, Nautilus search excluded as it is not a recovery apparatus)

Is this true?

Hopefully, your recommendations will work, but my concern is that Ubuntu does not appear to have a second and more concrete (failsafe) method for recovering deleted files. It does not have an undue option (which reverts to a prior desktop or time period, or simply another system related method for recovering files that have been deleted.

Trash is it?

What do you think?

Revision history for this message
Eliah Kagan (degeneracypressure) said :
#13

You are correct that Ubuntu does not have an easily accessible, down-to-earth method for undeleting files. As far as I know, this is also the case in every other operating system, including Microsoft Windows and Mac OS X.

Undeleting files is technically complicated, especially on the filesystems commonly in use today (ext4, NTFS, and so forth). Deleted files generally need to be undeleted to a separate volume, and it is easy to accidentally overwrite them by continuing to use the volume on which they reside. I don't think it's a problem that there's no mechanism for undoing emptying the trash or deleting a file permanently (you use Shift+Delete for this...is it possible you did that?) because one is unlikely to do those things by accident and warning is given.

But if Ubuntu is "permanently" deleting files that should be going into the Trash, or under other circumstances where they shouldn't be "permanently" deleted, then that *is* a very big problem--that would indicate an important bug that needs to be fixed.

BabyGeek reported experiencing a "similar" situation, but did not indicate in what *way* it was similar to this situation. But if multiple people are experiencing deleting files to the Trash, only to find that they're not in the Trash (or anywhere else), then that is of course a very serious problem.

Can you give more details about your experience, BabyGeek?

Revision history for this message
John Osborne (josborne) said :
#14

Eliah, Sam, BabyGeek,

Since I have not yet turned the computer off, perhaps the method outlined here may be
valuable, do you think?
http://www.linux.com/archive/articles/58142

Revision history for this message
Eliah Kagan (degeneracypressure) said :
#15

That only works is some program has the file open. (For instance, in the example given in those instructions, the program called less had the file open in the background.) Given your description, it seems that the chance that this is the case is extremely low.

But so long as you are careful, and you attempt to recover the file to another volume (not the partition where it had previously existed--perhaps an external hard disk instead), the risk associated with attempting it should also be low. Make sure the second argument to the cp command specifies the path of another volume.

But unless you have some reason to think some program has the deleted files open or you are an experienced shell user (i.e. experienced using the command line), I think the risk associated with your making a mistake and accidentally writing to the filesystem is higher than the chance that this method will be successful.

Revision history for this message
Eliah Kagan (degeneracypressure) said :
#16

Correction: "That only works is some program has the file open." --> "That only works IF some program has the file open."

Revision history for this message
John Osborne (josborne) said :
#17

I seem to be having multiple issues.
1. No minimized items in the tray.
2. No Partitioned disk usage reports

When looking at the suggested solution ( https://help.ubuntu.com/community/DataRecovery) I noticed that it was asking me to partition the drive which would delete all of the data in the adjoining partition to my knowledge.

Revision history for this message
John Osborne (josborne) said :
#18

When I used the check file system software in the hard drive manager i received an error message that said this. "Device is mounted and no online capability in fsck tool for file system". These issues seem connected to the missing file issue. Thanks.

Revision history for this message
Eliah Kagan (degeneracypressure) said :
#19

What's the relevance of not having minimized items in the "tray"? What do you mean by the "tray"? Are you talking about the Window List (where your windows are usually shown), or the notification area (which some people call the "system tray")? Is this on the live CD?

Where does that say you should partition the drive? It presents partitioning as a problem, rather than a solution, right?

As for your fsck error...did you follow this advice? "Shut down the affected machine as soon as possible, and restart it from a LiveCD or LiveUSB. Be certain that the "live" cd does not automatically mount any partition or swap space." Following that advice, before attempting to recover lost files using the methods presented on that page, is extremely important.

Revision history for this message
adam (adamvongaertner) said :
#20

I am the tech helping John O. The computer you are dealing with has been running for almost a month with internet caching for this site and many others. Im sure running from the disk will not matter since any information has currently most likely been overwritten.

I have associated this problem with a partition error and not a true file loss. So the prior suggestion was unfortunatly not relevant. Since the lost data resides in a damaged partition the files are probably located in a no write zone anyway. So, I used testdisk utility to recover the bad partition.

I am not entiirely sure why, but the previous IT tech created 4 partitions. I understood the one for XP and the one for Ubuntu but the other two I am at a loss for. Prior to this issue the write part. had bumped into a sapce restriction. John emptied some items in the trash but not the files in question. These files may have dissapeared from the desktop along with the "window list" at microsoft this is called the "sytem tray", and some other system tools yet to be discovered. I beleive a repair should be performed on the OS and Aero should be reinstalled if that affects the window list.

I am also not sure with testdisk how or where it places retrieved files as well. The utility just runs and thats it. I'm not sure if it is doing anything since no files seem to be retrieved or are listed as retrieved.

Thanks for the help.

Revision history for this message
John Osborne (josborne) said :
#21

Ran, testdisk and here are the results:

The following partition can't be recovered:

PARTITION START END Size in sectors
Linux 9540 0 1 30408 254 58 335260480

[continue]

Revision history for this message
John Osborne (josborne) said :
#22

Re: CANONICAL

Contacted Canonical on with my situation and urgency and they promised to return my inquiry within two days. Thus far no response. Received the same non-response on two previous requests to subscribe as a member. On one occasion spoke with a senior manager; asking him to take my credit card and sign me up - never heard back.

Anyone share my experience, or have a suggestion for expediting a response to a subscription application. Once over the hurdle of joining Canonical, did you find them responsive and helpful?

Can you help with this problem?

Provide an answer of your own, or ask John Osborne for more information if necessary.

To post a message you must log in.