90 TB of Data Missing

[wildhawk64]

I've logged into the UnraidGui and find that suddenly my server has gone from about 2TB free as of last night to 89TB free. Almost all my previous shares are now missing, including any data in those shares. None of the devices seem to be unable to mount or anything like that. I tried to reboot, just hoping it'd all come back but alas. I know it was there, at least in some point, as of about six hours ago as I was streaming music and suddenly it didn't work, didn't think anything of it at the time. Any suggestions that hopefully don't involve redownloading 90TB of stuff?

 

doomsdaydevice-diagnostics-20231031-2114.zip

[wildhawk64]

Additional odd thing, all of the disks show some small amount of usage, 100 GB or so, its different on every individual disk, but when I explore them with MC or any other way they show no data on them at all.

[Kilrah]

3 hours ago, wildhawk64 said:

Additional odd thing, all of the disks show some small amount of usage, 100 GB or so, its different on every individual disk, but when I explore them with MC or any other way they show no data on them at all.

XFS drives always show a percentage used by metadata when empty, about 100GB for 16TB, normal.

Diagnostics are after the reboot so any hints about what happened will be gone.

 

Did you have your unraid ui exposed to the internet? People trying to hack into unraid servers and deleting all content has been a thing for quite a while.

 

[wildhawk64]

                   The control panel itself? Not as far asI know. I had a few things through nginx like a password manager and a redirect to plex but as far as I'm aware those were the onl y things                       

[Frank1940]

I looked through your shares configuration files and everyone of them was set to 'Public'.  That means that anyone who gained (or had) access to your LAN could have deleted those files.    This could be any smart device including a cell phone or an IOT.  Below is a table with the permission for all three Unraid share security settings:

 

Summary of security modes:

Public-      All users including guests have full read/write access.

Secure-    All users including guests have read access, you select which of your users have write access.

Private-    No guest access at all, you select which of your users have read/write, read-only access or no access.

 

Read through the PDF file in the first post in this thread:

 

         https://forums.unraid.net/topic/110580-security-is-not-a-dirty-word-unraid-windows-10-smb-setup/

IF it is a necessary for some reason for a 'guest' to have access to certain share, set that share to 'Secure' and they will have 'read-only' access.  (In fact, I restrict the users for all of my shares--- which are all set to 'Private' --on my server to 'read-only' access for everyday usage.  When 'read-write' is required, I turn it on (by modifying the permissions for that user) for only that session.  This prevents Malware running on a client from modifying any data on the server.) 

[trurl]

Looks like someone must have formatted the disks.

[wildhawk64]

It was more of a convenience I set up to help somebody else access them in the past and subsequently forgot about entirely. Dang, learned some lessons the hard way I guess.