Restore Data after rm

[AngryPig]

I had a share with a folder I could not delete so I went into the UNRAID terminal and ran roughly the following

 

cd mnt
cd disk6
cd Backups
rm -r /*

 

I believe I f***ed up by putting the slash and it went to home instead of the current path and now my server is offline. I did Ctrl + C after I started to realise

What should I do going forward? I have 2 parity drives, 1 cache and 6 data drives

Edited September 15, 2022 by AngryPig

[trurl]

Don't know how far it would have gotten to actually deleting your data. The OS is at / so that would explain why things broke, and your data is all in the mnt subfolder of /, and the flash drive in the boot subfolder of /.

 

The OS will be fine if the flash drive is fine, since it is unpacked fresh from the archives on flash at each boot. Do you have a flash backup?

 

Reboot and see what happens, then we can go from there.

[AngryPig]

48 minutes ago, trurl said:

Don't know how far it would have gotten to actually deleting your data. The OS is at / so that would explain why things broke, and your data is all in the mnt subfolder of /, and the flash drive in the boot subfolder of /.

 

The OS will be fine if the flash drive is fine, since it is unpacked fresh from the archives on flash at each boot. Do you have a flash backup?

 

Reboot and see what happens, then we can go from there.

 

Just tried rebooting but the web gui didn't load. Will have to try again with a monitor attached to the machine and see what it says

[trurl]

58 minutes ago, trurl said:

Do you have a flash backup?

 

[AngryPig]

12 minutes ago, trurl said:

Do you have a flash backup?

 

No I do not. I have only just started using the server with some non-critical data at this point. Was trying to set everything like that up.

 

Re-booting with a monitor and it just goes straight to BIOS. Trying to boot to USB does nothing

Edited September 15, 2022 by AngryPig

[ChatNoir]

Pull your flash drive and check the content on another computer.

[AngryPig]

14 minutes ago, ChatNoir said:

Pull your flash drive and check the content on another computer.

 

It's blank 😶

[AngryPig]

Just now, AngryPig said:

 

It's blank 😶

 

I booted into Kali and ran testdisk on the blank drive and did an undelete. This is what it got back

 

https://pastebin.com/xxeqtgEL - not sure if links allowed so also included text file

 

Does this look like all of it? Should I put it back onto the USB and try booting to it?

recovered.txt

Edited September 15, 2022 by AngryPig
Added text file

[AngryPig]

3 hours ago, AngryPig said:

 

I booted into Kali and ran testdisk on the blank drive and did an undelete. This is what it got back

 

https://pastebin.com/xxeqtgEL - not sure if links allowed so also included text file

 

Does this look like all of it? Should I put it back onto the USB and try booting to it?

recovered.txt 9.31 kB · 3 downloads

 

I rebuilt the USB and copied the config files over. My array settings are back but my drives all say they are at minimal data usage so I am guessing the data is gone unless the parity check comes back and finds mistakes

[Kilrah]

Parity only helps you about a dead drive, not about filesystem issues. If files were deleted parity will have been updated in realtime to reflect that.

[ChatNoir]

Might be possible to recover some data from the drive ?

rm probably only removed the pointer to the files, not the actual data.

 

I'd suggest to prevent any writes to the drives until you have investigated those options.

 

Unless it's non-critical as you said and you can start over.

[trurl]

6 hours ago, AngryPig said:

Does this look like all of it? Should I put it back onto the USB and try booting to it?

I know you already went past this, but the answer is NO. Some file and folder names have been changed to UPPER CASE for some reason (not sure that matters since flash is FAT anyway) and the first character of some names have been replaced with _

 

But that brings me to this

3 hours ago, AngryPig said:

copied the config files over

Copied them from where?

 

3 hours ago, AngryPig said:

parity check comes back and finds mistakes

As mentioned, parity can't help with this. Parity check only checks parity, it won't do anything to any data disk. Even a correcting parity check only corrects parity, it doesn't do anything to any data disk. Parity itself contains none of your data.

 

1 hour ago, ChatNoir said:

Might be possible to recover some data from the drive ?

rm probably only removed the pointer to the files, not the actual data.

 

I'd suggest to prevent any writes to the drives until you have investigated those options.

 

Unless it's non-critical as you said and you can start over.

Any recovery options probably involve paid software

[trurl]

You must always have a current flash backup. Flash contains all of your configuration, which is any settings made in the webUI, including disk assignments. It also contains your license.

 

And another standard lecture point

 

You must always have another copy of anything important and irreplaceable. Parity is NOT a substitute for backups.

[AngryPig]

12 hours ago, trurl said:

I know you already went past this, but the answer is NO. Some file and folder names have been changed to UPPER CASE for some reason (not sure that matters since flash is FAT anyway) and the first character of some names have been replaced with _

 

But that brings me to this

Copied them from where?

 

I used testdisk undelete to make a copy of the files and then I compared the files name to what was on the fresh install of Unraid and renamed and copied them over after checking the contents to make sure they were not scrambled.

 

 

14 hours ago, ChatNoir said:

I'd suggest to prevent any writes to the drives until you have investigated those options.

 

I did consider this but since I copied my config over it auto-started the array, I presume the parity check has made writes overnight. Need to look up how to boot without starting array when it is set to auto-start for future reference.

 

 

12 hours ago, trurl said:

Any recovery options probably involve paid software

 

14 hours ago, ChatNoir said:

Unless it's non-critical as you said and you can start over.

 

Thankfully other than some already uploaded to YouTube, GoPro footage, it was only my plex and video game libraries that was on there so not worth paying for it

 

 

12 hours ago, trurl said:

You must always have a current flash backup. Flash contains all of your configuration, which is any settings made in the webUI, including disk assignments. It also contains your license.

 

You must always have another copy of anything important and irreplaceable. Parity is NOT a substitute for backups.

 

As mentioned above and previously it was non-critical and I had only just set up the array so not the end of the world. Anything critical already follows 3-2-1-1-0. This was just an accident branching out into the DIY NAS space as opposed to my other backup options.

 

 

15 hours ago, Kilrah said:

Parity only helps you about a dead drive, not about filesystem issues. If files were deleted parity will have been updated in realtime to reflect that.

 

That is a fair point which appears to have since been echoed by others. I should have realised this myself but in the wee hours of the morning when it happened I was a bit too tired for sense

[trurl]

11 hours ago, AngryPig said:

how to boot without starting array when it is set to auto-start

edit the file config/disk.cfg on flash