Recover files deleted with command sudo apt autoremove

[Chrwdy]

Start File Manager. In Cinnamon, the file manager is Nemo which hides hidden files by default. Select View then Show hidden files.

Look for directory .mozilla. Open. If the directory is not there, you somehow selected the option to remove configuration files when removing a package. I have seen that only in the Synaptic Package Manager.

Inside .mozilla, there should be a directory for firefox. One of the subdirectories has your profile. When you reinstall Firefox, it may create a new profile and you may need to swap profiles or copy the content of the old to the new.

Backintime is an equivalent to Timeshift for your home directory. There is also a Backup tool in LM but I prefer Backintime as I can configure it for multiple backups. Whatever you do, backup before reinstalling Firefox.

Thanks. I had already re-installed Firefox before realizing that all my documents and downloads and videos are gone. When I select 'show hidden files', my downloads and documents aren't there.

[Chrwdy]

It advised to command: sudo apt-get purge firefox and then sudo apt autoremove. Now ALL my documents and all my downloads are completely gone.

I believe these forum members who say these commands would not remove the files in your home directory. So if your files are gone, they have probably been gone for a long time. Can you think of any files other than 'oracle girl' to search for? When is the last time you accessed a personal file and which one was it? Where was it located?

Please look in your Trash (on your desktop) for your files.

Please type each of these commands in a terminal and report the results (if you want to):

Code: Select all

ls -la ~/Downloads
ls -la ~/Documents
ls -la ~/Music
ls -la ~/Desktop
ls -la ~/Pictures
ls -la ~/.mozilla/firefox
ls -la ~/.local/share/Trash/files

Then follow JerryF advice about TestDisk if you can't find the files.

Thanks for your help. I really appreciate it!
The Trash is totally empty. When I type the above command with /Downloads, I get:
total 8
drwxr-xr-x 2 christine christine 4096 Nov 26 01:55
drwxr-xr-x 18 christine christine 4096 Dec 5 16:03
christine@christine-HP-Pavilion-17-Notebook-PC:~S

When I type the command with /Documents, I get:
drwxr-xr-x 2 christine christine 4096 Nov 27 15:55
drwxr-xr-x 18 christine christine 4096 Dec 5 16:03
christine@christine-HP-Pavilion-17-Notebook-PC:~S

When I try it with /Desktop, I get:
drwxr-xr-x 2 christine christine 4096 Nov 26 01:49
drwxr-xr-x 18 christine christine 4096 Dec 5 16:03
christine@christine-HP-Pavilion-17-Notebook-PC:~S

When I try the trash command, I get:
ls: cannot access '/home/christine/.local/share/Trash/files[/code]' : No such file or directory

All Greek to me! Thanks for any assistance you can offer!

[Chrwdy]

It advised to command: sudo apt-get purge firefox and then sudo apt autoremove. Now ALL my documents and all my downloads are completely gone.

I believe these forum members who say these commands would not remove the files in your home directory. So if your files are gone, they have probably been gone for a long time. Can you think of any files other than 'oracle girl' to search for? When is the last time you accessed a personal file and which one was it? Where was it located?

Please look in your Trash (on your desktop) for your files.

Please type each of these commands in a terminal and report the results (if you want to):

Code: Select all

ls -la ~/Downloads
ls -la ~/Documents
ls -la ~/Music
ls -la ~/Desktop
ls -la ~/Pictures
ls -la ~/.mozilla/firefox
ls -la ~/.local/share/Trash/files

Then follow JerryF advice about TestDisk if you can't find the files.

I forgot to answer about the last time the files were there. They were all there immediately before I uninstalled and reinstalled Firefox. I did search for other file names, and none turned up.

[Chrwdy]

I tried using the sudo find command, as Flemur suggested, and I've attached a screenshot of the response.image1.png

Ignore those "errors"

Use this, leave the *'s in:

Code: Select all

sudo find / -iname "*oracle*" 

I tried this command again, with another file name. Now my terminal command has hundreds of things flashing by so fast I can't read it:
2: generic
timeshift/snapshots/date/localhost/usr/src/linux-headers-5.4.0.7 on and on. Sometimes I can make out generic/include/config. Sometimes some of the message is stable, and then after the last forward slash, stuff just flashes by, and sometimes all of it flashes by, but I can make out timeshift or snapshot, or Platform/x86. ...and it's been flashing by for over two minutes now. I hope I didn't release a kracken....I hope it means my files are in there somewhere? Yikes!

[Chrwdy]

I tried using the sudo find command, as Flemur suggested, and I've attached a screenshot of the response.image1.png

Ignore those "errors"

Use this, leave the *'s in:

Code: Select all

sudo find / -iname "*oracle*" 

I tried this command again, with another file name. Now my terminal command has hundreds of things flashing by so fast I can't read it:
2: generic
timeshift/snapshots/date/localhost/usr/src/linux-headers-5.4.0.7 on and on. Sometimes I can make out generic/include/config. Sometimes some of the message is stable, and then after the last forward slash, stuff just flashes by, and sometimes all of it flashes by, but I can make out timeshift or snapshot, or Platform/x86. ...and it's been flashing by for over two minutes now. I hope I didn't release a kracken....I hope it means my files are in there somewhere? Yikes!

Well, never mind all that panic. Now that it's done, I see it was just quickly searching my computer...and the result is "no such file or directory." However, when I scroll through what was searched, almost all of it was /timeshift/snapshot/.... So, if one wouldn't expect my documents or downloads to be saved in Timeshift, but only my OS, maybe I'm not looking in the right place?
There were some searches that start with /var/lib/flatpak/.... Is lib = Libre Office? So, maybe it did search for my documents (they're mostly all saved as .odt files) and nothing turned up?
It also searched /usr/share/icons/Mint.... and /usr/src/linux-headers..... and /sys/devices/pci0000... and /etc/glvnd (or apport or rcp or protocols or X11).
Sorry for dumb questions - I'm in over my head here.
Does it look that my search indicates the documents and downloads are nowhere on my computer, or just not in the parts of it I searched with the command sudo find / -iname "*file name*"[/code] ?

[motoryzen]

Is lib = Libre Office

No. never assume it means Libre Office..BUT it does contain Libre Office coherent files.

/usr/lib contains certain configuration files for much important stuff.

[acerimusdux]

post the output of this command:

Code: Select all

cd ~;du -h --max-depth=1|sort -hrk 1|head -30

and then maybe also:

Code: Select all

cd /home;sudo du -h --max-depth=1

This might also help:

Code: Select all

inxi -Fxxxrz

[Chrwdy]

post the output of this command:

Code: Select all

cd ~;du -h --max-depth=1|sort -hrk 1|head -30

Here's what I got with the first command:
christine@christine-HP-Pavilion-17-Notebook-PC:~$ cd ~;du -h --max-depth=1|sort -hrk 1|head -30
310M .
145M ./.cache
111M ./.config
43M ./.mozilla
13M ./.var
440K ./.local
88K ./.cinnamon
76K ./.pki
12K ./.linuxmint
8.0K ./.gnupg
8.0K ./Documents
4.0K ./Videos
4.0K ./Templates
4.0K ./Public
4.0K ./Pictures
4.0K ./Music
4.0K ./Downloads
4.0K ./Desktop



and then maybe also:

Code: Select all

cd /home;sudo du -h --max-depth=1

This might also help:

Code: Select all

inxi -Fxxxrz

[Chrwdy]

post the output of this command:

Code: Select all

cd ~;du -h --max-depth=1|sort -hrk 1|head -30

Here's what I got with the first command:
christine@christine-HP-Pavilion-17-Notebook-PC:~$ cd ~;du -h --max-depth=1|sort -hrk 1|head -30
310M .
145M ./.cache
111M ./.config
43M ./.mozilla
13M ./.var
440K ./.local
88K ./.cinnamon
76K ./.pki
12K ./.linuxmint
8.0K ./.gnupg
8.0K ./Documents
4.0K ./Videos
4.0K ./Templates
4.0K ./Public
4.0K ./Pictures
4.0K ./Music
4.0K ./Downloads
4.0K ./Desktop



and then maybe also:

Code: Select all

cd /home;sudo du -h --max-depth=1

With this command I get:
christine@christine-HP-Pavilion-17-Notebook-PC:~$ cd /home;sudo du -h --max-depth=1
[sudo] password for christine:
312M ./christine
312M .
christine@christine-HP-Pavilion-17-Notebook-PC:/home$

I don't understand what this means. Any ideas?

This might also help:

Code: Select all

inxi -Fxxxrz

[Chrwdy]

post the output of this command:

Code: Select all

cd ~;du -h --max-depth=1|sort -hrk 1|head -30

Here's what I got with the first command:
christine@christine-HP-Pavilion-17-Notebook-PC:~$ cd ~;du -h --max-depth=1|sort -hrk 1|head -30
310M .
145M ./.cache
111M ./.config
43M ./.mozilla
13M ./.var
440K ./.local
88K ./.cinnamon
76K ./.pki
12K ./.linuxmint
8.0K ./.gnupg
8.0K ./Documents
4.0K ./Videos
4.0K ./Templates
4.0K ./Public
4.0K ./Pictures
4.0K ./Music
4.0K ./Downloads
4.0K ./Desktop



and then maybe also:

Code: Select all

cd /home;sudo du -h --max-depth=1

This might also help:

Code: Select all

inxi -Fxxxrz

Here's the response to this command:
christine@christine-HP-Pavilion-17-Notebook-PC:~$ inxi -Fxxxrz
System:
Kernel: 5.4.0-90-generic x86_64 bits: 64 compiler: gcc v: 9.3.0
Desktop: Cinnamon 4.6.7 wm: muffin 4.6.3 dm: LightDM 1.30.0
Distro: Linux Mint 20 Ulyana base: Ubuntu 20.04 focal
Machine:
Type: Laptop System: Hewlett-Packard product: HP Pavilion 17 Notebook PC
v: 0883100000305B10000620100 serial: <filter> Chassis: type: 10
serial: <filter>
Mobo: Hewlett-Packard model: 1971 v: 95.33 serial: <filter> UEFI: Insyde
v: F.22 date: 01/20/2014
Battery:
ID-1: BAT0 charge: 27.3 Wh condition: 31.1/31.1 Wh (100%) volts: 12.1/10.8
model: Hewlett-Packard Primary type: Li-ion serial: <filter>
status: Unknown
CPU:
Topology: Dual Core model: Intel Core i5-3230M bits: 64 type: MT MCP
arch: Ivy Bridge rev: 9 L2 cache: 3072 KiB
flags: avx lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx bogomips: 20752
Speed: 1197 MHz min/max: 1200/3200 MHz Core speeds (MHz): 1: 1197 2: 1197
3: 1197 4: 1197
Graphics:
Device-1: Intel 3rd Gen Core processor Graphics vendor: Hewlett-Packard
driver: i915 v: kernel bus ID: 00:02.0 chip ID: 8086:0166
Display: x11 server: X.Org 1.20.11 driver: modesetting
unloaded: fbdev,vesa resolution: 1600x900~60Hz
OpenGL: renderer: Mesa DRI Intel HD Graphics 4000 (IVB GT2)
v: 4.2 Mesa 21.0.3 compat-v: 3.0 direct render: Yes
Audio:
Device-1: Intel 7 Series/C216 Family High Definition Audio
vendor: Hewlett-Packard driver: snd_hda_intel v: kernel bus ID: 00:1b.0
chip ID: 8086:1e20
Sound Server: ALSA v: k5.4.0-90-generic
Network:
Device-1: Ralink RT3290 Wireless 802.11n 1T/1R PCIe
vendor: Hewlett-Packard driver: rt2800pci v: 2.3.0 port: 4040
bus ID: 01:00.0 chip ID: 1814:3290
IF: wlo1 state: up mac: <filter>
Device-2: Realtek RTL810xE PCI Express Fast Ethernet
vendor: Hewlett-Packard driver: r8169 v: kernel port: 3000 bus ID: 02:00.0
chip ID: 10ec:8136
IF: eno1 state: down mac: <filter>
Drives:
Local Storage: total: 698.64 GiB used: 59.09 GiB (8.5%)
ID-1: /dev/sda vendor: HGST (Hitachi) model: HTS541075A9E680
size: 698.64 GiB speed: 3.0 Gb/s rotation: 5400 rpm serial: <filter>
rev: A590 scheme: GPT
Partition:
ID-1: / size: 686.18 GiB used: 59.08 GiB (8.6%) fs: ext4 dev: /dev/sda2
Sensors:
System Temperatures: cpu: 48.0 C mobo: N/A
Fan Speeds (RPM): N/A
Repos:
No active apt repos in: /etc/apt/sources.list
Active apt repos in: /etc/apt/sources.list.d/audio-recorder-ppa-focal.list
1: deb http://ppa.launchpad.net/audio-recorder/ppa/ubuntu focal main
Active apt repos in: /etc/apt/sources.list.d/brave-browser-release.list
1: deb [arch=amd64] https://brave-browser-apt-release.s3.brave.com/ stable main
Active apt repos in: /etc/apt/sources.list.d/official-package-repositories.list
1: deb http://muug.ca/mirror/linuxmint/packages ulyana main upstream import backport
2: deb http://archive.ubuntu.com/ubuntu focal main restricted universe multiverse
3: deb http://archive.ubuntu.com/ubuntu focal-updates main restricted universe multiverse
4: deb http://archive.ubuntu.com/ubuntu focal-backports main restricted universe multiverse
5: deb http://security.ubuntu.com/ubuntu/ focal-security main restricted universe multiverse
6: deb http://archive.canonical.com/ubuntu/ focal partner
Info:
Processes: 210 Uptime: 3m Memory: 7.67 GiB used: 1017.1 MiB (13.0%)
Init: systemd v: 245 runlevel: 5 Compilers: gcc: 9.3.0 alt: 9 Shell: bash
v: 5.0.17 running in: gnome-terminal inxi: 3.0.38 '

So, I don't really understand all this, but it looks like I'm only using 8.5% of local storage capacity. My documents and downloads would have taken up much more than that. There's only one partition, so I don't have another partition where my documents and downloads might be hiding. All of the videos, documents, downloads folders, etc. have 4.0 - 8.0 K associated, so essentially empty (which is what prompted my plea for help).
The /cache has 145 M - is it possible things are hiding in there?
Also, if I open my file manager, and then the file system, I see the root folder has an X over it, and there's a swapfile that has an X over it. Should I be worried about that, if I decide to just start fresh and move on without retrieving my data?

[all41]

These files seem important as you have solicited experts to aid in recovery.
sudo apt autoremove did not touch your home directory--and I agree with others that have expounded this--no way jose
Those files may have been relocated, deleted, overwritten--who knows?
One thing you need to be aware of:
files recovered using testdisk or photorec will not retain the original filenames or attributes. Mostly you will recover unrecognizable names--example '34ade322caa'
which rarely indicate the name of the file. You may sort through thousands of filenames to recognize a few.
Just a heads up

[acerimusdux]

Well I have no idea what kind of documents or data you had, or how much of them. But if you had any amount of videos, music, or pictures, I think you certainly would have used more than 1GB. Basically, having only 312M in all of /home confirms there is almost nothing there. I wouldn't have too much hope for the .cache directory that makes up nearly half of that. My firefox cache alone can get to 1GiB if I don't clear it. And ~/.cache/thumbnails can also run over 100M.

For the rest of the drive though, it's a relatively large drive, so 59 GiB, though only 8.6%, is still a fairly large number. Mint alone likely uses less than 20GiB. So there's still maybe 40 GiB of stuff there unaccounted for? I think this is most likely something like your timeshift OS backups, though. But maybe it's possible you backed up your /home in timeshift though? And then maybe even restored it to when it was almost empty?

So maybe try the / directory.

Code: Select all

cd /;sudo du -h --max-depth=1|sort -hrk 1

Most of Mint will be in /usr, but that will still likely be < 10GB. If anything looks espectially large, I want you to run this command from that directory, too. For example, if /var is more than a few GB, try:

Code: Select all

cd /var;sudo du -h --max-depth=1|sort -hrk 1

And how big is your swapfile?

Code: Select all

ls -lhS /swapfile

But if you want to preserve the chances of having any data professionally recovered though, you should stop using the drive normally, and only mount it read-only. Basically, shut it down, and boot from a live Mint USB, and then run commands from there. You can open up a terminal there and run:

Code: Select all

sudo mount -r /dev/sda2 /mnt

Then, because / of that drive is now on /mnt, you would just have to alter those commands slightly, so:

Code: Select all

cd /mnt;sudo du -h --max-depth=1|sort -hrk 1

Code: Select all

cd /mnt/var;sudo du -h --max-depth=1|sort -hrk 1

[Chrwdy]

These files seem important as you have solicited experts to aid in recovery.
sudo apt autoremove did not touch your home directory--and I agree with others that have expounded this--no way jose
Those files may have been relocated, deleted, overwritten--who knows?
One thing you need to be aware of:
files recovered using testdisk or photorec will not retain the original filenames or attributes. Mostly you will recover unrecognizable names--example '34ade322caa'
which rarely indicate the name of the file. You may sort through thousands of filenames to recognize a few.
Just a heads up

Thanks for the heads-up!

[Chrwdy]

Well I have no idea what kind of documents or data you had, or how much of them. But if you had any amount of videos, music, or pictures, I think you certainly would have used more than 1GB. Basically, having only 312M in all of /home confirms there is almost nothing there. I wouldn't have too much hope for the .cache directory that makes up nearly half of that. My firefox cache alone can get to 1GiB if I don't clear it. And ~/.cache/thumbnails can also run over 100M.

For the rest of the drive though, it's a relatively large drive, so 59 GiB, though only 8.6%, is still a fairly large number. Mint alone likely uses less than 20GiB. So there's still maybe 40 GiB of stuff there unaccounted for? I think this is most likely something like your timeshift OS backups, though. But maybe it's possible you backed up your /home in timeshift though? And then maybe even restored it to when it was almost empty?

So maybe try the / directory.

Code: Select all

cd /;sudo du -h --max-depth=1|sort -hrk 1

Thanks so much for your help. Very kind of you and all the forum members to offer help. Here's the response to this command:

Code: Select all

christine@christine-HP-Pavilion-17-Notebook-PC:~$ cd /;sudo du -h --max-depth=1|sort -hrk 1
[sudo] password for christine:             
du: cannot access './run/user/1000/gvfs': Permission denied
du: cannot access './proc/3074/task/3074/fd/4': No such file or directory
du: cannot access './proc/3074/task/3074/fdinfo/4': No such file or directory
du: cannot access './proc/3074/fd/3': No such file or directory
du: cannot access './proc/3074/fdinfo/3': No such file or directory
58G	.
40G	./timeshift
8.4G	./var
5.5G	./usr
1.5G	./lib
452M	./opt
312M	./boot
301M	./home
21M	./sbin
18M	./bin
14M	./etc
4.0M	./root
1.5M	./run
92K	./tmp
16K	./lost+found
8.0K	./media
4.0K	./srv
4.0K	./mnt
4.0K	./lib64
4.0K	./cdrom
0	./sys
0	./proc
0	./dev

So, it looks like your guess was right, that the 40G is in Timeshift. That might be about right, because last I checked, there were 3 backups. So, based on this, I am guessing my files and downloads are completely gone. Luckily, I've had over a week to come to terms with the loss of all my data. Since I don't know what exactly happened to delete everything, I am wondering if I should start with a clean install of Linux Mint, in case my system has been corrupted somehow. Or should I use Timeshift, on the off-chance that some of my documents and downloads perhaps are saved in there? Looking through my File System, several of my system files have an X over the folder. Maybe that means a password is required to access, but maybe it means it's corrupted somehow.
Thanks!

[acerimusdux]

It is probably best to do this from a usb booted livesystem, if you can mount your drive from there and look at it. But either way, open a filemanager, look in the timeshift directory, look in snapshots, choose one, look in the localhost directory, and you should see the backup of your system. If there is a /home folder there, look in that.

Normally timeshift is configured to ignore the /home folders, and the /home directory there will be empty. But it is possible yours was backed up.

So check for each snapshot you see there.

[Chrwdy]

It is probably best to do this from a usb booted livesystem, if you can mount your drive from there and look at it. But either way, open a filemanager, look in the timeshift directory, look in snapshots, choose one, look in the localhost directory, and you should see the backup of your system. If there is a /home folder there, look in that.

Normally timeshift is configured to ignore the /home folders, and the /home directory there will be empty. But it is possible yours was backed up.

So check for each snapshot you see there.

Thanks - the home directory in timeshift is empty. I'll be able to recover some of my data from a previous external HD backup, but because I thought Timeshift was backing up everything, and I thought I could use Timeshift from a bootable USB to set my computer to an earlier date, like Time Machine in Mac. So, I haven't been making external backups as regularly. Other users have given suggestions for proper back up systems. Lesson learned.

Anyways, thanks to you and all the other forum members who gave advice to try to help me sort this out. Much appreciated.

[mikeflan]

We'll try to refrain from badgering you about this, but you should be using 2 or more different backup methods, and have 3 or more backups of the critical data. And every time you start using a new backup method you test the restore procedure first. It takes more than 2 drives (or backup locations) to follow this advice.