Accidentally deleted data moving between partitions, what should I do?

Understanding Data Recovery After Accidental Partition Deletion: A Guide for Linux Users

Accidental data deletion can be a stressful experience, especially when it involves critical or valuable files. If you’ve recently moved data between partitions and inadvertently caused data loss, knowing the right recovery steps is essential to minimize data loss and restore your files efficiently. In this article, we’ll explore best practices for data recovery in Linux environments, focusing on imaging strategies and suitable tools.

The Scenario

Suppose you have a Linux system with multiple encrypted partitions—specifically, a LUKS-encrypted ext4 partition and a LUKS-encrypted Btrfs partition. You intended to move files from the ext4 partition to the Btrfs partition using the mv command, followed by synchronizing additional data with rsync. Unfortunately, executing rsync afterward resulted in the deletion of data that had already been moved, leading to unintended data loss.

Key Considerations

• The data is non-critical but important enough to warrant recovery efforts.
• You have not mounted the affected drive since the data loss.
• Your goal is to recover as much data as possible without risking further damage.

Recommended Recovery Approach

1. Stop Using the Affected Drive Immediately
   To prevent overwriting deleted data, cease all writes and mounting attempts to the drive. Continued use reduces the chances of successful recovery.

2. Create a Disk Image (Bit-by-Bit Copy)
   Instead of working directly on the original partitions, create forensic images of the affected partitions or the entire drive. This approach preserves the current state and allows for multiple recovery attempts without risking further damage.

3. Imaging Entire Drive: If storage space permits, imaging the entire drive ensures you don’t miss any deleted data not contained within a specific partition.

4. Imaging Partitions Only: If drive space is limited, focus on creating images of only the partitions involved in the data movement.

5. Choosing What to Image

6. If possible, image the entire drive to accommodate future recovery options, especially if you’re unsure about the exact location of the deleted files.

7. If space constraints prevent full drive imaging, target the specific partitions.

8. Select Appropriate Tools for Imaging
   Linux offers several reliable tools for disk imaging:

9. dd and ddrescue: Command-line utilities for creating exact images of disks or partitions. ddrescue is