Botched attempt to delete a share, what should I check into?

[Boot]

I wasn't thinking and tried to delete a share, that had 4tb of data, with Krusader.  Krusader hung for several minutes, and I hit cancel hoping to go do delete it the proper way (also probably dumb of me).

 

However, the data appears to be gone from the drives, and the share is gone from the UI. There was still a boot config file, and after removing it, I'm not getting any errors in the log files. 

 

Is there anything else I should do or look into? It was pretty sensitive data and I want to make sure it is truly deleted; without any lingering files or references.

 

Thanks!  

[JonathanM]

1. Reboot and check to see if anything comes back.

2. Do a file system check on all the participating drives to make sure things didn't get in a strange state.

3. Overwrite with new data to remove the ability to recover using file system undelete tools.

    a. How many drives in the array had that share on it?

    b. How big are those drives?

 

Truly permanently deleting just a subset of data on a drive is tricky, it's easier to erase entire drives if the data is very sensitive.

[Boot]

1 hour ago, JonathanM said:

1. Reboot and check to see if anything comes back.

2. Do a file system check on all the participating drives to make sure things didn't get in a strange state.

3. Overwrite with new data to remove the ability to recover using file system undelete tools.

    a. How many drives in the array had that share on it?

    b. How big are those drives?

 

Truly permanently deleting just a subset of data on a drive is tricky, it's easier to erase entire drives if the data is very sensitive.

Thank you for the advice. You're always super helpful! Would love your thoughts on the below & attached.

 

1. I've attached my system log after a reboot, I don't recall seeing the last 2 warnings before, but it's been a while since I've looked at the logs and could be unrelated.
2. As for the file system check, I don't know what the results mean. I see steps being skipped, but don't know if that's good or bad haha.
3. The share was isolated to a single 18tb drive. Is there a better way to clear it than shrinking the array, clearing / reformatting the drive, and re-adding it? 

Thanks again!

 

 

 

[JonathanM]

File system check looks fine to me, so that would indicate the deletion worked. That means the file entries in the table of contents for the drive were successfully removed. That does NOT mean the files are gone.

 

Reformatting doesn't remove the actual file data either, it just resets the table of contents pretty much like deleting does.

 

If you really want to make sure the data is gone, you need to write new data to the areas of the drive that actually contained the old data. That's not trivial, but you don't need to break the array to accomplish it either.

 

There are multiple ways to do it, easiest from a beginner point of view would be to simply copy non sensitive content to the drive until it filled up.

 

If you remove the drive, rebuild parity with the remaining drives, then add the drive back it will be overwritten with zeroes, which is just as effective as filling with random data with current drives. However, that means losing protection for the period of time while parity is rebuilding.

[Boot]

Makes sense! I have plenty of nonsensitive content I can transfer to the drive to fill it up with new data. I'll go with that approach.

 

Thank you so much! You've been a big help. 🍻