Restore files on headleass server

[OiPenguin]

Hi! While attempting to set up backup with rsync, I've managed to delete our entire archive of home videoes (kids now 17 and 19)... I've got an Ubuntu server (headless, 22.04.4 LTS) set up with raid so surely the files should be there and possible to restore, however how do I do it? Please, can someone give me some valuable pointers.

Yours sincerely,

Lars

[dragonfly41]

Oh dear, this is the second rsync disaster I have read in days ..

https://ubuntuforums.org/showthread.php?t=2496829

Because the data is so important my advice is wait for a cluster of others to respond.
Don't act on one opinion.

To park in your memory (a) always have backups and (b) know how to use "dry run" in rsync.
The limited advice I have read is to take a copy of your raid setup then try recovery on the copy.
Yes that means more outlay but that is the cost.
Apart from that my thoughts are possibly testdisk but .. wait .. for incoming expert tips.

P.S.(1) there are specialist data recovery forensic expert services to try as last resort but they are costly.

P.S.(2) Further advice here. https://www.reddit.com/r/linux/comme...re_my_chances/

P.S.(3) And do not use your computer too much in the interim since the deleted space might be overwritten.
Use another PC to watch for forum replies here. Or use a LiveUSB.

[aljames2]

+1

Giving this a bump, and while you wait, adding some additional reading on the topic of raid types and the objective when using them. Raid can be useful to provide redundancy in case a drive fails, it can give you time to replace a failed drive, and therefore keep your storage array alive. It is not a backup technology. It sounds like you were starting to realize you needed a backup plan. Rsync is a good choice and as Dragonfly has pointed out, there are safe ways of using it. Do you by chance have any other copies of these videos/data anywhere else in the world? Can they be ripped off the original DVDs, USBs, Micro SSDs, Cloud, Tape, wherever?

https://en.wikipedia.org/wiki/Standard_RAID_levels

[dragonfly41]

Another reflection.
Do not attempt to install any recovery software on the same drive where data was deleted in error. You run the grave risk of overwriting the data you are hoping to recover. Hibernate your RAID and do the recovery in a separate PC or LiveUSB. And better plan is apply the recovery on a clone of the RAID. You will need a separate drive into which (hopefully) you write any recovered data. On one occassion I was attempting recovery using TestDisk and PhotoRec and realised that I needed a separate bucket into which I saved recovered files. In LiveUSB experiment with GUI tools such as Grsync and LuckyBackup (both with dry run buttons). You might have to create (on another PC) a persistent LiveUSB using MkUSB (or Rufus in Windows) but on a large external drive (SSD) rather than the usual low cost tiny flash drive. This will give you space for saving any recovered files into persistent LiveUSB. With a clone of your RAID it will be safer to experiment. You can probably clone your RAID in a specialist cloning shop. For example I use StarTech devices where you can clone devices. And also StarTech dual docking bay. Ask StarTech where is there a local shop for cloning.

https://www.startech.com/en-gb/faq/r...es-explanation
https://www.startech.com/en-gb/hdd/unidupdock

P.S. Sorry, just noticed that UNIDUPDOCK is discontinued but some shop might still use it.

I use this:
https://www.startech.com/en-gb/hdd/sdock2u313r (plus ICY DOCK caddy MB882SP-1S-1B from FARNELL)

Worst case if this fails you will have space for future formal backups (perhaps two or three in separate physical locations). As pointed out by others (such as @TheFu) SSD's can fail. So think n+1 redundancy in the future.

==================================

P.S. I have no knowledge of this recovery service but I offer this shop as an example (in the U.K).

https://www.datarecoveryspecialists....BoCaXIQAvD_BwE

Now I suggest there must be a similar service in OP's country. Just check their client base for references.

Quote from their site:

"We provide an online diagnostic report of the recoverable data, allowing you to make an informed decision before purchasing an actual recovery."

[OiPenguin]

Thanks to both of you for your replies. I'll add some extra information:

- I'm aware of the dry-run option, and should of course have used it, but didn't. Also, if I did, I believe the faulty destination (see below) would have been untouched and I would probably have made this mistake anyway.

- I understand that I, for the future, will need to install a GUI on my server. I've not got the skills to safely rely on ssh + cli. Once this is solved, I'll install a desktop environment, log in with remote desktop and use the default backup (Deja Dup?).

- I'll elaborate slightly on the error I've done. I've used a script based on this "recipe", but believe I've mixed around source and destination, hence deleting most of what I was supposed to backup.
#!/bin/bash

# Source and destination directories
dest="/backup/destination"
src="/home/your_username"

# Run rsync command
rsync -av --delete "${src}" "${dest}"
(source: https://www.slingacademy.com/article...backup-script/ )

- I'm not sure which type of Raid I'm using and don't know how to find out. Anyway, as I understand from other threads, Raid protects against disk failure, not errors like I've made. The files (or the reference to the files) will be deleted on all partitions almost instantly.

- I have now shut down my server to avoid any changes to my server before I have a solution.

- I appreciate the suggestions of data recovery shops and have sent a request to a local shop (since I'm in Norway, not UK).

- I may have some sort of backups, however the purpose of this rsync-attempt was to establish a proper routine for backups to disks which I could store outside the house. I do have two options: 1) An old NAS, which if I'm able to make it run, will probably have approx 80-90% of what was lost. I believe the disks are encrypted so if the NAS won't run the files will probably be hard to retrieve from the disks. 2) An old ubuntu server, made with spare parts, which won't start. If the non-start is due to disk failure, the files will be lost, however if its due to failure of some other components, the files should be retrievable from the disks, since they are not encrypted.

- Hence, my preferred solution is to recover files from my main server. I've read up a bit about Testdisk. I'm acutely aware of not installing Testdisk on the server, but on an external machine (i.e. the laptop I'm using now). However, if I use this machine and connect a proper SSD, how do I access the raid disks on my server from this machine. Through Nautilus/Networks?

[OiPenguin]

An update:

- I've been able to connect my old NAS to the network. I'm able to view the content, which is all 2013 and older. However, when attempting to access one of the sub folders I get the error: "failed to mount windows share software caused connection abort"

- I've pulled out the disks from the non-working server (not the one where I made the rsync-mistake. It has three disks and I've connected them to my laptop with an Akasa external hard drive enclosure.

#1
Seagate Barracuda 160 Gbytes 7200.9
OS
Able to mount

#2
Samsung HD103UJ (1000GB/7200 rpm/32M)
1,0 TB (1 000 204 886 016 bytes)
Linux RAID Member (version 1.2)
/dev/sda
721ed0ef-f114-562d-1840-2e736637764c
Unable to mount

#3
Samsung HD103UJ (1000GB/7200 rpm/32M)
no info
Shown in Disks as JMicron USB to ATA/ATAPI Bridge (0100)
Won’t show in Gparted
Unable to mount

The essential challenge is mounting the disks. I assume the reason it will not mount is that I've set up Raid. However, since Raid 1 is exact mirroring of two disks (according to Wikipedia), shouldn't it be possible the disks individually? On the positive side, I have established that the disks are working, however not in the current old server, so I have to find a way to mount one or both disk to be able to retrieve the contents.

[dragonfly41]

I am not a RAID user. I prefer to managed separate drives in caddies in StarTech dual docking bay.

Since it is important you follow the correct path, I consulted an AI assistant (phind.com) and posed this query:,

A user by error using rsync deleted important files from a RAID drive in Ubuntu server. What advice can be given to attempt to recover deleted files from array? The user has a separate laptop to attempt recovery using tools such as testdisk. But how to recover from a RAID? What tools are recommended from Ubuntu repo? Scalpel?

I threw in Scalpel as an afterthought since there is a Ubuntu forum somewhere discussing forensic recovery tools.

I suggest that you start by trying Phind in your laptop browser with that query. It brings up some advice to follow (some covered earlier in this discussion). More ideas the better. Subscription is modest although you can try free.

Intuitively I still feel that you should explore investing in StarTech RAID bay.

I have evolved my own "off piste" methods of holding assets in containers in of all things a CherryTree notes editor. Might seem odd thinking but I can "wrap" assets in individual CherryTree *.ctd files including context notes. I search for them using Recoll indexing engine using query ext:ctd. Hover over recoll query field to see cheat sheet.They are self contained containers of images, notes, code. You can also use Recoll to search for text within the containers. Perhaps describing a family event.

But that is for future thinking after this incident. Priority is to find experts to try to revover. But note that you will be charged even if they fail to recover your lost files. Better for the future learn both home grown methods and external recovery specialists (with strong client base).


P.S. As you have researched, RAID protects from device failure, not human failure. Studying causes of failure is a hobby of mine. What can screw up?

Now here is an old thread. A very old thread.

https://forums.tomshardware.com/thre...-cases.654268/

[dragonfly41]

Submitting this follow up query to Phind.com ..

In breaking up an old NAS with three drives this error is shown. "failed to mount windows share software caused connection abort". Explain how to access such NAS drives from Ubuntu.

yields advice ..

.... install samba ...

Expanded version from session. Although some instructions do not copy and paste easily to ths forum and you should run your own Phind queries.

To access NAS drives from Ubuntu, especially after encountering the error "Failed to mount Windows share: Software caused connection abort," you can follow these steps based on the information provided in the sources:

• Install Samba: If not already installed, you need to install Samba, which provides file and print services for various Microsoft Windows clients and can integrate with a Windows Server domain.

sudo apt update
sudo apt install samba

• Configure Samba: The error you're encountering might be due to SMB1 being disabled by default in Samba 4.11, which is used in Ubuntu 20.04. You can enable SMB1 or specify a different protocol version in the Samba configuration file.

• Enable SMB1: If your NAS requires SMB1, you can enable it by editing the Samba configuration file. However, be aware that SMB1 is considered insecure and its use is generally discouraged.

sudo nano /etc/samba/smb.conf




Add or modify the following lines:

client min protocol = CORE




Save and exit the file.

• Specify SMB3: For a more secure connection, specify SMB3 as the minimum and maximum protocol version.

sudo nano /etc/samba/smb.conf




Add or modify the following lines:

client min protocol = SMB3
client max protocol = SMB3




Save and exit the file.

• Restart Samba: After making changes to the Samba configuration file, restart the Samba service to apply the changes.

sudo systemctl restart smbd

• Access the NAS Share: Try accessing the NAS share again. If you're using Nautilus (the default file manager in Ubuntu), you can do this by navigating to "Other Locations" and selecting the NAS device. If the issue persists, ensure that the NAS is correctly configured to share files and that there are no network issues preventing access.

• Check for Updates: Ensure your system and Samba are up to date. Some users have reported that updating Samba resolved their issues.

sudo apt update
sudo apt upgrade

• Consult NAS Documentation: If you continue to experience issues, consult the documentation for your specific NAS device. There may be additional configuration steps required to enable file sharing with Ubuntu.

Remember, the exact steps may vary depending on your NAS model and the version of Ubuntu you are using. Always ensure that your system is secure and that you're following best practices for network security and file sharing 12

The key is to use precise prompts. The art of "prompt engineering". Or it is garbage in, garbage out.

[MAFoElffen]

Coming into this late, so I didn't read through the long post details, just skipped over the summary of it.

I don't see that as a problem with RAID itself (just another factor), but rather that you used an rsync option that deleted the files, once it confirmed that is backed them up (one-by-one)...

So you have "a backup" of them correct? Or was there a problem with the files rsync copied over? They could just be restored.

If you didn't have good copy of the files, then use "testdisk" or "photorec" to recover them.

[OiPenguin]

Thanks for the input. I'm scared of loosing my data so I'm currently awaiting an assessment and a price estimate from a professional. StarTech is interesting, but probably as a supplement to my server, not a replacement, once I've recovered my lost data.