Hello everyone!

 

I just registered to the forum due to a problem I am facing.

I have been running unraid (currently in version 7.0.1) for a long time on my home server (mostly regular PC parts).

 

Today I checked into jellyfin and was pretty confused, as a lot of my series/movies were no longer listed. As this must be a hiccup, I quickly restarted the container but it still showed only a couple of items. So I accesses my shares from my PC, same items, nearly empty.

I continued to check the unraid array and there it was: my array is showing 21.3/24 TB free. 

A few days earlier I was fighting with my limited free space, closing in on the last few hundred GB... so I somehow lost close to 20 TB of my data at some point over the last few days!

 

Unraid is not showing problems with the disks and I had no parity check for the last few weeks I think (like 6 weeks back I had some some trouble with a faulty PSU that caused a few reboots, but since that has been fixed all was smooth).

 

Can someone please advice me on how to troubleshoot this and possibly try to get my data back as I am not that experienced?

I will attach the diagnostics bundle, I already looked at it but I am unsure what I am looking for. In the previous syslog the only thing that is odd to me is the stop/restart on the 22nd at around 16:09. I did not do any manual stops/starts of the array recently.

I hope the diagnostics do not expose too much information, if there is anything sensitive in there I should omit, please let me know and I remove it.

I do not have any special logging enabled I think, so I guess there are no sophisticated access logs for the shares.

 

Any help is appreciated, at the current time I would like to think that none of the machines in my home network are compromised... but honestly I am not sure I would even know, at least one devices has the credentials of my main account (which has write access on all shares) stored.

 

Thanks in advance!

 

TLDR;

- found 90% of my data missing from parity enabled array

- no HDD errors

- not sure what to look for in the logs

- one odd array stop/start at 16:09 on 22nd in the logs that I did not do manually

- can't rule out that my network/one of my devices is compromised?

unraid-diagnostics-20250423-0231.zip

Everything looks normal.

The two most common reasons for data being missing like that is having hacked after being server internet facing, or a media app doing some cleanup and deleting files.

I have two internet facing services, just checked the logs and they do not show a log-in in the last few days... ofc there is always a broader risk vector than the services themselves if any part is exposed to the internet so I understand this is not conclusive... still very odd.

 

I have two follow-up questions:

1. Can someone suggest a good data recovery approach for xfs?
2. In any case, I strongly consider clearing and reinstalling my main PC and would like to do something similar with unraid:
   • I am not knowledgeable enough to know if my unraid has been compromised and a backdoor is kept open, can someone help me plan how I can keep most of my unraid setup / configuration in tact while still creating a fresh image (transferring only what is required to leave possible backdoors behind)?

UFS explorer has been used before with good results.

 

You can try redoing the flash drive, backup the current one first and then recreate it using the USB tool and just restore the bare minimum, like the key, super.dat and the pools folder for the assignments, also copy the docker user templates folder (\config\plugins\dockerMan\templates-user), it may also be a good idea to recreate the docker image.