General Questions • Current best practice suggestions for data recovery after complete data loss (supposedly update-induced)

Hi there!

A friend lost all his data after performing what he says was a regular system update, prompted by the update mechanism. He is currently running debian 11 "bullseye" (oldstable) with the default GNOME desktop. He will be bringing his laptop to me in two days hoping that I can recover as much data as possible (no he didn't perform regular backups and yes, he has used his laptop and performed multiple shutdowns since this happened ). I used to be relatively well versed at basic linux system administration but that was over 10 years ago and I haven't kept up-to-date since, so I'm hoping for some current best practice suggestions.

Here's what I would have done back in the days:

• boot from a usb flash drive using the current version of the grml live system (based on debian testing)

• create an image to work with using dd_rescue

• examine the log files in /var/logs/apt/history and /var/logs/dpkg.log to see whether anything unusual happened during the update and /var/log/syslog to determine if anything else out of the ordinary occurred during that time.

• use testdisk and photorec to attempt file recovery

Oh, one more thing: I have never seen or heard of anything like this happen on a debian stable install before and am still struggling to get my head around what might actually have occurred. All I can safely say at the moment is that my friend won't have done anything outside of the GUI and won't have installed third-party tools. I'm assuming that a release upgrade still isn't prompted by the default debian stable (GNOME) update mechanism, am I right? (I haven't used the default desktop myself for some years now)
Any other thoughts?

I would appreciate your thoughts and suggestions.
Best wishes,
airmed

Statistics: Posted by airmed — 2024-11-25 13:55 — Replies 2 — Views 129

---