HELP. Not sure what has happened.

[newtusmaximus]

HP Desktop dc7700p 4GB Ram LL3.4 64bit up to date wired LAN to router.  While deleting a large folder in an external usb drive, the desktop froze with much Desktop drive activity.  a box appeared  stating writing to external  hard drive please do not switch off.  The external usb drive (1 TB) was about half full.
After a couple of hours the Desktop was still frozen and its hard drive was still active. 
So foolishly i decided to switch off via the on/off button.

RESULT, The EXternal Hard drive appears to be unaffected, the large folder having been removed.  HOWEVER The Hard Drive on the desktop has been left with a very basic presence of linuxlite ( No feather, no xcfe menu  etc. All folders  ( desktop, documents, downloads etc) are empty and  the contents appear to have been deleted.  NO thunderbird, etc.  The Desktop drive now shows  circa 130 GB free as to 30GB free beforehand.

It would appear therefore that all that has been deleted??  However the user name for the desktop still shows. 

The question therefore, A) How did this happen? and B) Is the  original data still on that drive somehow but not "registered"  . I know this might be wishful thinking on my part, but loaqthe to reset the drive if there is any possibility of recovering.

AS it is a few months since I backed up, there is a lot od recent data that it looks as if I may have lost - very embarrassing to say the least!!

Hope the above account makes some sense.  Not in the best frame of mind at the moment as you may appreciate

Thoughts appreciated.  Thanks
Written from another PC

Update. Gpart states no recoverable files found.

[Richard B]

Bad luck, whatever happened. Obviously you should not do anything that might write to the drive. I suggest putting it in a USB caddy and cloning it to a spare drive with DD say (I prefer ddrescue - install gddrescue - as it shows progress and will re-try problem areas), Then perhaps use GParted/ Device/ Attempt data rescue, though I have never tried it. No doubt others will suggest different rescue tools.


As one who often "forgets" to do backups [size=78%], I hope you get somewhere.[/size]

[trinidad]

The data may still be there, however if you zeroed the drive it's gone. Tough break then. If you still have an extra older kernel in your grub menu try booting from it and see if a functional desktop appears. Given that you are not sure what happened; if an older kernel boots and you can get a DE you can proceed from there, possibly even update, and then proceed afterwards from another drive or partition with a file carver but a 100GB loss will be slow going.

TC

[newtusmaximus]

Thanks trinidad & Richard B.
A) gpart  did not solve the issue - repair - No files found.
B) Booted desktop from external usb HDD that has a fully working LL2.8 32 bit . Grub identified the desktop HDD (sda1) and chose earliest kernel present 4.4-077? recovery
Ran fsk? file recovery  than dpk?  and then finally continued boot from sda1. 

No luck..  still  barest LL - sudo password unchanged, can see main added packages, skype, dropbox  Mega etc  but to files.
Tried running system.log - lines galore but could find a means of printing out.

How can  I access the sys log  and save it so that I could post it ( somewhere? not to overload this forum's server) ) .  Perhaps from that someone could spare the time to see 1) What happened and b) if there is a chance of recovering the data.
Hope this makes sense -  Still very much a linux newbie - do idea what is under the "hood"
Thanks again

[trinidad]

When the grub menu comes up hit advanced options and then e to edit the menu of the newest kernel and backspace out the quiet splash options and hit F10. Watch the processes for failures as the machine attempts to boot. If its too fast open a terminal once booted and enter:

journalctl -b0 SYSLOG_PID=1

With this command you can take a guess which boot was the last successful one by changing the -b qualifier to any number 0 being the current boot, the higher the number the farther back and you won't have to show them all. I think the PID number for the DE is 5 but I may be wrong. 1 is the PID number for initrd.

TC

[newtusmaximus]

Thanks Trinidad.  Awaiting new HDD for the desktop. so I can  get working again.  Will keep this old drive "as is" post failure and attempt to find out what went wrong later.  Will follow your guidelines and come back later with various "print outs" etc. if I may. Date of crash 19/09/17.  so will have to work back  boot by boot from today.