Accidental partial deletion of data on XFS encrypted drive with rm -rf /mnt/disk

[Apeiron]

I was performing data copy and cleanup using disk to disk transfers. I scrolled to the wrong command and mistakenly ran

rm -rf /mnt/disk4

 

I immediately saw the error and killed the process. Using a disk usage comparison, and modified directory times, it looks like I deleted about 100GB of data from one of the folders on disk4. 

 

Reviewing the forums and FAQ, I saw info for ReiserFS and the "general help" link is broken on the FAQ. 

 

My data drive is using encrypted XFS. I fortunately did not delete anything critical and I have a backup. No other changes to the data filesystem have taken place. 

 

I'm looking for advice on next steps. Should I attempt a recovery operation, or restore from backup? I think restoring would guarantee 100% recovery, but a recovery is probably easier and faster. I'd be ok with a <100% recovery operation if most of the data could be recovered. 

 

I have experience recovering NTFS drives for windows using testdisk on linux, but never with XFS, or an encrypted drive. 

solidsnake-diagnostics-20220802-1026.zip

[trurl]

I think restoring from backup is actually going to be easier

[JonathanM]

5 minutes ago, Apeiron said:

My data drive is using encrypted XFS

Yeah, restore from backup is the only real option. XFS recovery is bad enough, add encryption to the mix and I'm not sure I would even know a good path forward. Encryption complicates data recovery immensely, pretty much on purpose. If you use encryption a comprehensive backup strategy is essential.

 

8 minutes ago, Apeiron said:

I have experience recovering NTFS drives for windows using testdisk on linux, but never with XFS, or an encrypted drive. 

WAY different. XFS recovery isn't exactly easy and the tools aren't free AFAIK. It's assumed if you are advanced enough to use XFS with encryption, you know enough to keep good backups.

[Apeiron]

Thank you for the advice. Makes good sense. I always laughed jokingly at people who ran rm -rf / as root, and now I'm practically guilty of it. Lesson learned. Thanks.