after i restarted when i start the array all my drive show as 100% free space. i had aobut 50+tb out of 72tb capacity filled. now its showing all empty. all shares/dockers/vm everything is missing .

unraid-i7-diagnostics-20250519-2243.zip

 

i looked at the system log and it looks a bit scary , did i just get hacked?

Edited May 20, 20251 yr by vvelumm
added syslog

Not hacked per se, but every script kiddie is trying to log in.  Is your server in your router's DMZ?  Are you forwarding ports 80 / 443 / 22 to the server from the router?

no it is not in dmz, only thing i have is nat for plex port 32400 and that is it. I am using this new ATT BGW320-505 router they gave. I looked through the usual areas nothing shows ports forwarded.

 

I don't understand how all my data shows missing, I just tried opening the drives in USB booted Ubuntu and the drives are all empty, minus a few remnants of appdata files. I've been using unraid for almost 10 years i don't understand what happened.

 

I do remember I hit Mover manually. I did this because the drives were getting full (cache and my temp storage drives). I saw that there is some mover split something error in version 7.0.1? is that what happened?

Edited May 20, 20251 yr by vvelumm

Start the array, let things get up and running for a bit then post a new set of diagnostics, stop the array and pull the ethernet cord out / shut off the server

i attached the new diagnostic file here.

 

just read this, is this what happened? using the mover? 

 

"This is a small but important release, resolving a potential data-loss issue in 7.1.0 and 7.1.1 where the recent "mover empty disk" feature does not handle split levels on shares correctly."

 

I did make a few changes to my network , i changed the att mode/router to passthrough and using my old Deco routers. I did just update the OS version to latest.

unraid-i7-diagnostics-20250520-0105.zip

1 hour ago, vvelumm said:

using the mover? 

Did you empty an array disk? Data loss only applies to that, not moving data from pools to array or vice versa.

I did not empty an array disk. All I did different was hit click on mover button which I never had to do before but for some reason I saw both my cache and temporary download pool were about 95% full.

 

I can confirm everything was fine and the last time I copied files to share was around 2pm. Around 7 pm I couldn't access Plex so I logged in via GUI in to restart the container. It gave me an error and wouldn't let me restart it. I did a reboot using the Reboot button. When it came back is when I saw all drives in array appeared to be wiped clean, including my cache and temporary pool.

 

 

 

26 minutes ago, vvelumm said:

I did not empty an array disk

In that case it wasn't the mover bug that caused the issue, the most common causes of data going missing like that, are the server being exposed to the internet and hacked, or a media container doing some cleanup or being misconfigured and deleting the data.