6

My brother told me two weeks ago that some of his files were missing and last week all of his files disappeared (together with some installed programs). The weird thing is that the folder structures are still there - it is just the files in the folders that are missing.

It seems that I can recover the non-backed-up files with photoRec (of testDisk), but would like to know what can cause this and how do I prevent it from happening in the future?

P.S We did clean the computer with an air blower right before all the files disappeared, but I doubt that this can cause it seeing that some disappeared before then and the computer only has xUbuntu 13.04 on it.

EDIT I forgot to mention that all configs were also reset (launcher(s) settings and background, including email accounts).

chesedo
  • 1,689
  • 14
  • 25
  • 2
    Any cloud syncing software running? Other people who may have access? What applications usually open these files? Syncing with external USB devices? Just to list some of billions of possible causes to look out for. – Takkat Jun 24 '13 at 08:54
  • 1
    @Takkat ownCloud is running, but only on the documents folder while all the files in the home directory have disappeared - so can't be that (hopefully). Also see edit that will rule out the other and why I'm a bit worried about it. – chesedo Jun 24 '13 at 09:05
  • Is there another account on that machine also affected? Are the HOME directories on a separate partition? Any applications crashed before this happened? Were there another user account or any other directories **outside** `/home/` created? – Takkat Jun 24 '13 at 09:21
  • 8
    Check your system logs (e.g. `/var/log/syslog` + archives) for filesystem check automatic "fixes". If you have silent data corruption on your disk drive, this can cause inodes to be deleted or much worse things can happen. Also check the SMART state of your hard drive in "Disks" (maybe you need to install `gnome-disk-utility` on your system first). I have seen the very same issue with an OCZ Vertex SSD - it was almost dead and just before it corrupted my data badly. – gertvdijk Jun 24 '13 at 09:27
  • @Takkat His is the only account (and only user). And all files are under the same partition with the rest of xUbuntu. Also no program crashes. – chesedo Jun 24 '13 at 09:28
  • You can check your disk for failures using Disk Utility. Install it from Ubuntu software center. – jobukkit Jun 24 '13 at 09:36
  • @gertvdijk The last syslog archive starts from the morning the last disappearance was spotted. The drive also don't seem to have SMART feature (Disks shows smart disabled) - the computer is a bit old. – chesedo Jun 24 '13 at 09:47
  • 1
    I would not be so sure the air blower had nothing to do with data loss. For example, if you got dust *in* the hard drive rather than out of it, this could explain data loss. – don.joey Jun 24 '13 at 09:49
  • @Private To you think that moving the computer before it was cleaned (and full of a lot of dust) can account for the initial data loss - that some dust got into the hard-drive then as well? – chesedo Jun 24 '13 at 17:50
  • Hard to say. It is not even sure that dust is at the origin of the problem. If I were you I would try to exclude all software problems. If then you do not find the problem, your best hypothesis is a hardware problem. In that case, you can no longer consider the hard drive safe. – don.joey Jun 25 '13 at 07:06
  • Funny. This reminds me of a certain system call named `unlink`. All kidding aside though, while very slim, it's possible that the links were written onto the dust which happened to be ever so slightly ferromagnetic, and when you blew it out, the links disappeared. Realistically though, your hard drive is likely too fail in the near future. Invest in a new one and do a transfer from a LiveCD via `sudo dd if=/dev/[olddrive] of=/dev/[newdrive]` – haneefmubarak Aug 04 '13 at 22:08
  • @haneefmubarak Could be possible (but taken that is slim), the files were written to the disk a few days before that - I will make a mental note to install an OS AFTER cleaning the system to avoid such weird slim occurrences. He is hoping to get a laptop within a few months so hopefully the drive will hold till then (although no files has disappeared since) - drives are quiet expense here. – chesedo Aug 05 '13 at 15:45

1 Answers1

0

While this 'could' be a failing disk, the fact that no other directories were affected makes me think that it's more likely something else. Once (or twice), I've accidentally deleted EVERYTHING on my drive and it acted exactly the way you are describing this. Most of the files were gone instantly but a good portion didn't go away until all processes which used them also quit. In summary, my guess is that your brother ran something like: cd ~ && rm *

krowe
  • 443
  • 2
  • 12