Hi, so.. my migration to a new Server did not go well so far....

 

I installed Nextcloud and Postresql and set one of those paths wrongly, apparently to the root of my disks...

And instead of just adding new files to the root, it deleted everything. Which was surprisingly fast....

 

I have found xfs_undelete, but I am not exactly sure how to use it.

 

root@Tower:/etc/xfs_undelete-15.0# ./xfs_undelete -t 2024-11-19 -o /dev/sdc /dev/sdc
Cannot create output directory. can't create directory "/dev/sdc": file already exists
root@Tower:/etc/xfs_undelete-15.0# ./xfs_undelete -t 2024-11-19 -o /mnt/disk4 /dev/sdc
This isn't an XFS filesystem or filesystem image.
root@Tower:/etc/xfs_undelete-15.0# ^C
root@Tower:/etc/xfs_undelete-15.0# ./xfs_undelete   /dev/sdc
This isn't an XFS filesystem or filesystem image.
root@Tower:/etc/xfs_undelete-15.0# lsblk
NAME     MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
loop0      7:0    0  63.4M  1 loop  /lib
loop1      7:1    0 338.8M  1 loop  /usr
loop2      7:2    0    20G  0 loop  /var/lib/docker/btrfs
                                    /var/lib/docker
loop3      7:3    0     1G  0 loop  /etc/libvirt
sda        8:0    1  59.8G  0 disk  
└─sda1     8:1    1  59.8G  0 part  /boot
sdb        8:16   0 119.2G  0 disk  
└─sdb1     8:17   0 119.2G  0 part  
  └─sdb1 254:1    0 119.2G  0 crypt /mnt/cache
sdc        8:32   0  14.6T  0 disk  
└─sdc1     8:33   0  14.6T  0 part  
sdd        8:48   0   2.7T  0 disk  
├─sdd1     8:49   0    16M  0 part  
└─sdd2     8:50   0   2.7T  0 part  /mnt/disks/Volume
md4p1      9:4    0  14.6T  0 md    
└─md4p1  254:0    0  14.6T  0 crypt /mnt/disk4
root@Tower:/etc/xfs_undelete-15.0# ./xfs_undelete -t 2024-11-19 -o /dev/sdd2 /dev/sdc1
Cannot create output directory. can't create directory "/dev/sdd2": file already exists
root@Tower:/etc/xfs_undelete-15.0# ./xfs_undelete -t 2024-11-19 -o /mnt/disks/Volume /dev/sdc1
This isn't an XFS filesystem or filesystem image.

 

 

What am I doing wrong? Why does it say that it isn´t an xfs filesystem? Is it because it is encrypted? Why couldn´t I just use it on the open array?

Could you please help me to get this to run? I guess restricting the recovered FIles to under 2GB would be enough too.

 

EDIT:

Okay, just found that I have to use the "other" disk name.

With this the program just found a hundred files, but only trash .txt, and .php files. Not sure why the rest ist not recovered.

 

./xfs_undelete -t 2024-11-19..-4hours --no-remount-readonly -o /mnt/disks/Volume/  /dev/mapper/md4p1 

 

What am I doing wrong here?

Is there any other drive I have to use to get the data from my disk back?

Edited November 19, 20241 yr by Torlew

You can try a file recovery app like UFS explorer.

Thank´s, it is able to open the encryption.

However, it does not find anything, except the files that were written by the Container.

 

How can this be? The delete happened in less than a half hour. That shouldn´t be enough time for a complete wipe, no?

The Scan is complete within two seconds.

Can't really help with that.