Data deleted by unknown cause on Ubuntu
by james000 from LinuxQuestions.org on (#4T3P2)
Hi,
We have a ubuntu 18.4 server, hosted on Digital ocean. There is /dev/sda disk of 300 GB. Last Saturday we had data of more than 200GB. Today I checked, it is just 13GB of data. There is no cron and no login if I check in last command.
I ran "fsck -N /dev/sda" and it came up clean.
In absence of backup, I was searching tools, which can tell me what data was deleted and I found this -- https://vitux.com/how-to-recover-del...ough-testdisk/
If somebody of aware of its functionality, can suggest me, if its (below) log is telling me something?
I understand it is not Linux native tool, but I am trying to give a shot if this tool is helpful in giving any pointer.
And this filesystem is ext4, not sure why below log is telling me "Ext2 superblock found at sector 21233664"
Code:root@serv-22:/vol11/btr/# more testdisk.log
Thu Oct 24 07:25:34 2019
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.15.0-46-generic (#49-Ubuntu SMP Wed Feb 6 09:33:07 UTC 2019) x86_64
Compiler: GCC 7.2
ext2fs lib: 1.44.1, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 322 GB / 300 GiB - CHS 39162 255 63, sector size=512 - DO Volume, FW:1.5.
Partition table type (auto): None
Disk /dev/sda - 322 GB / 300 GiB - DO Volume
Partition table type: None
Interface Advanced
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
P ext4 0 0 1 39162 128 6 629145600
ext4 blocksize=4096 Large_file Sparse_SB Recover, 322 GB / 300 GiB
search_superblock
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 2 (block=0, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 1310720 (block=163840, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 1835008 (block=229376, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 2359296 (block=294912, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 6553600 (block=819200, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 7077888 (block=884736, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 12845056 (block=1605632, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 21233664 (block=2654208, blocksize=4096)
ext4 0 0 1 39162 128 6 629145600
superblock 0, blocksize=4096 []
ext4 16 81 2 39178 209 7 629145600
superblock 0, blocksize=4096 []
ext4 48 243 4 39211 116 9 629145600
superblock 0, blocksize=4096 []
ext4 81 150 6 39244 23 11 629145600
superblock 0, blocksize=4096 []
ext4 114 57 8 39276 185 13 629145600
superblock 0, blocksize=4096 []
ext4 146 219 10 39309 92 15 629145600
superblock 0, blocksize=4096 []
ext4 407 240 26 39570 113 31 629145600
superblock 0, blocksize=4096 []
ext4 440 147 28 39603 20 33 629145600
superblock 0, blocksize=4096 []
ext4 799 144 50 39962 17 55 629145600
superblock 0, blocksize=4096 []
ext4 1321 187 19 40484 60 24 629145600
superblock 0, blocksize=4096 []
To repair the filesystem using alternate superblock, run
fsck.ext4 -p -b superblock -B blocksize device
search_superblockThanks in advance


We have a ubuntu 18.4 server, hosted on Digital ocean. There is /dev/sda disk of 300 GB. Last Saturday we had data of more than 200GB. Today I checked, it is just 13GB of data. There is no cron and no login if I check in last command.
I ran "fsck -N /dev/sda" and it came up clean.
In absence of backup, I was searching tools, which can tell me what data was deleted and I found this -- https://vitux.com/how-to-recover-del...ough-testdisk/
If somebody of aware of its functionality, can suggest me, if its (below) log is telling me something?
I understand it is not Linux native tool, but I am trying to give a shot if this tool is helpful in giving any pointer.
And this filesystem is ext4, not sure why below log is telling me "Ext2 superblock found at sector 21233664"
Code:root@serv-22:/vol11/btr/# more testdisk.log
Thu Oct 24 07:25:34 2019
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.15.0-46-generic (#49-Ubuntu SMP Wed Feb 6 09:33:07 UTC 2019) x86_64
Compiler: GCC 7.2
ext2fs lib: 1.44.1, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 322 GB / 300 GiB - CHS 39162 255 63, sector size=512 - DO Volume, FW:1.5.
Partition table type (auto): None
Disk /dev/sda - 322 GB / 300 GiB - DO Volume
Partition table type: None
Interface Advanced
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
P ext4 0 0 1 39162 128 6 629145600
ext4 blocksize=4096 Large_file Sparse_SB Recover, 322 GB / 300 GiB
search_superblock
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 2 (block=0, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 1310720 (block=163840, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 1835008 (block=229376, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 2359296 (block=294912, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 6553600 (block=819200, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 7077888 (block=884736, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 12845056 (block=1605632, blocksize=4096)
recover_EXT2: s_block_group_nr=0/2400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=4096
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 78643200
recover_EXT2: part_size 629145600
Ext2 superblock found at sector 21233664 (block=2654208, blocksize=4096)
ext4 0 0 1 39162 128 6 629145600
superblock 0, blocksize=4096 []
ext4 16 81 2 39178 209 7 629145600
superblock 0, blocksize=4096 []
ext4 48 243 4 39211 116 9 629145600
superblock 0, blocksize=4096 []
ext4 81 150 6 39244 23 11 629145600
superblock 0, blocksize=4096 []
ext4 114 57 8 39276 185 13 629145600
superblock 0, blocksize=4096 []
ext4 146 219 10 39309 92 15 629145600
superblock 0, blocksize=4096 []
ext4 407 240 26 39570 113 31 629145600
superblock 0, blocksize=4096 []
ext4 440 147 28 39603 20 33 629145600
superblock 0, blocksize=4096 []
ext4 799 144 50 39962 17 55 629145600
superblock 0, blocksize=4096 []
ext4 1321 187 19 40484 60 24 629145600
superblock 0, blocksize=4096 []
To repair the filesystem using alternate superblock, run
fsck.ext4 -p -b superblock -B blocksize device
search_superblockThanks in advance