how to recover removed directories

Question

I am trying to cross compile Qt for my raspberry, I tried it and I had some errors so I decided to change the configuration and try again maybe things will get better ..

I got this after configuration

Qt will be installed into '/opt/rpi/sysroot//usr/local/Qt-rasp4-5.14.2'.
Prior to reconfiguration, make sure you remove any leftovers from
the previous build.

So I said okay I am going to remove /opt/rpi/sysroot/ and /usr/local/Qt-rasp4-5.14.2

but I forgot that the root directory of my raspberry was mounted in that directory :(

mount raspberrypi.local:/ /opt/rpi/sysroot

and now / contains just that

root@amina-X550JX:/opt/rpi/sysroot# ls
boot  dev  proc  run  sys  var

almost everything was removed, even /home /bin ..

Is there a way to recover it or is it a waste of time ? should I just take a deep breath and install a new OS on my SD card ?

Answer 1

You are crying over spilled milk. rm is generally irreversible, and unless you had the Gold Codes stored on yor SD card, it's really not worth the effort.

So yes - re-flash your SD card, and start over.

For the future, consider maintaining periodic backups.

You shoulda' had a backup:

We have several must-read Q&A here on the subject of backups:

• Can a Raspberry Pi be used to create a backup of itself?

• How do I backup my Raspberry Pi?

• And saving the best (and easiest) for last, here's my favored backup solution

Answer 2

EXT4 is a very complex filesystem for which there is no common undelete algorithm. Recovery tools are typically only able to restore individual files, often without original file names or paths. If you plan to rely on undelete, I suggest you switch either to EXT2 which is simpler and provides better recovery options, or to XFS/ZFS/BRTFS which provide live snapshots (which you'll have to make upfront in order to be able to roll back, similar to backups).

Word of advice: don't login as root, run the shell as a regular user and use sudo with privileged commands. Also note that rm has the --one-file-system option which makes it skip subfolders populated by mount.

Answer 3

Presuming that your root filesystem is ext4... There are undelete tools you can use, but you must have turned off your machine immediately after discovering that the files had been deleted.

Linux is regularly writing logs and other files while it is running, and the way filesystems work, this means they will overwrite blocks which have been marked as "free" but contained the data that you want to restore.

If you DID turn your system off straight away, you could put your SD card in another Linux system and use the tools to scan the blocks to see if there are files that they recognise and can re-assemble. (all files larger than your block size will use multiple blocks, so finding the right chunks and putting them back together needs a bit of a miracle)

Depending on the tool you use, it is quite possible that the card should not be mounted in the system that you're doing the restoring on (because that could be writing to the card as well) - the recovery tools will scan the storage device block by block and possibly don't need to see the filesystem. Again, you don't want to write back to the card, so save restored files on a different device. (unless the tool you use is just marking the blocks as "not free" and updating the inode table and existing directories.)

Even in the best-case scenario, expect to find that a number of your files are corrupted and can't be restored. The longer it was running before you stopped it (don't even shut it down, just pull the power immediately) the less data you will be able to get back.

extundelete and ext4magic are tools which may work for you.

https://wiki.archlinux.org/index.php/file_recovery

I agree though, unless you had the only copy of some important data on that card, you're better off re-flashing it and starting from scratch. Don't trust the restored files to run off, undeleting is just to get back particular files to copy over to a different system before trashing and re-imaging the card.