Short history about my data loss:
I bought a new external 4TB WD My Book drive to backup the current 4TB WD My Cloud… Of course I have an obsession about the drive sleep, and since I couldn’t manage to make My Book sleep, I decided to edit some system files in hope it would allow it to sleep normally (like My Cloud). That’s how I found file /etc/nas/wdAutoMount.conf and… I was stupid enough to set the “AUTO_MOUNT_MOUNT_DIR” to the same as “AUTO_MOUNT_SHARES_DIR”. I thought it would prevent double mount of the external drive. After long reboot all my files were gone. My cloud literally deleted 3.5TB of data because of the change in that config file. I was very resigned, especially because I just bought a drive to backup stuff and secure this data
First I tried to recover with testdisk - It didn’t work, all files I could list were 0 in size. Then I disassembled My Cloud and put the disk to an external USB2.0 HDD reader… Then I used photorec on a Linux Mint virtual machine, but I noticed that this HDD case has a limit of 2TB So I recovered only half of files. It took over 2 days with USB2.0. Restored files were sometimes damaged (depends if they were parted or not). I put the HDD back to My Cloud, and used photorec from this topic. Another 2 or 3 days of scanning and it found many partial files, with no names.
Then I read more about data recovery on ext4 partitions, and I found an amazing program called: extundelete: http://extundelete.sourceforge.net/
I didn’t want to install it by apt-get to not destroy My Cloud totally, so I managed to compile version 0.2.4 using gpl-source-wd_my_cloud-04.00.00-607 build-armhf-package.sh script (replaced the default version 0.2.0 source files to compile 0.2.4). I think it’s only compatible with firmware v04, because I selected 64k pagesize. Anyway, here’s how to recovery your data:
PLEASE NOTE THAT NOT ALL FILES CAN BE RECOVERED WITH THIS METHOD, HOWEVER I WAS VERY SATISFIED FROM RESULTS.
- Don’t panick. Stress can only make it worse. Don’t write anything to My Cloud, disable all synchronization scripts, etc.
- Download folder “extundelete” from: https://1drv.ms/f/s!AuPZR_2KXo0NrXh-fp_l-IdN7hXt
- Paste that folder to an external USB HDD.
- Connect the external USB HDD to My Cloud.
- Type in terminal/putty: “umount /dev/sda4” many times, until you see a message that /dev/sda4 is not mounted. So basically type this command 6-10 times.
- Type: “cd /nfs”. Type “ls”. You should see names of shares. Find the name of your external HDD and type: “cd NAME”, where NAME is the disk name (different for everyone). Type “cd extundelete”.
- Type: “date -d “Aug 1 00:00” +%s” (change to any date you want, before the date when your files got deleted). It’s recommended to not restore junk files which were intentionally deleted before and could have incorrect size / increase recovery time.
- A number like “1501538400” should be shown. Copy it somewhere, for example to notepad.
- Type the actual recovery command: “./extundelete2.4 --restore-all --after 1501538400 /dev/sda4 --log ExtundeleteFullRestoreLog.txt”.
- Done. All recovered files should be put to “RECOVERED_FILES”. They should have the orginal file path/name, size and work even if were partial.
- Type “umount /dev/sdb1” to safely dismout your external HDD, and check recovered files on your computer. Note that many files will be found in folder “RECOVERED_FILES/lost+found”
I recovered around 1.5TB of useful data with this method. The rest was just big laptop backup archives, etc, not really important.
With extundelete you can also recover a single file, for example command (please note that file names are only for joke):
./extundelete2.4 --after 1501538400 --restore-file “shares/Mona/MonaNudesLeak.zip” /dev/sda4 --log ExtundeleteFileRestoreLog.txt
or a single folder, for example:
./extundelete2.4 --after 1501538400 --restore-directory “shares/Mona/MonaNudes/HopeToLeak” /dev/sda4 --log ExtundeleteDirectoryRestoreLog.txt
However, I would recommend to do a --restore-all, because some files won’t have their orginal path and will be available in “lost+found” instead.
Another good recovery program I found is ext4magic. I couldn’t compile it myself, but I found some version online, which somehow works on My Cloud.
- Download folder “ext4magic” from: https://onedrive.live.com/?id=D8D5E8AFD47D9E3!5880&cid=0D8D5E8AFD47D9E3
- Repeat steps 2-6 from METHOD1, but instead use “ext4magic” as the directory.
- To recover a single file type:
./ext4magic /dev/sda4 -r -f “shares/Mona/BigFile.zip” -d RECOVERED_FILES
I managed to recover a 500GB file with this method, which extundelete was unable to recover. However, when I tried to restore all files with ext4magic - it restored only a few files. Maybe I used a wrong command, I don’t know:
./ext4magic /dev/sda4 -M -d RECOVERED_FILES
My restored 500GB file was not full, but was taking only 250GB on disk. Thankfuly it was an archive so I was able to recover half of files, which actually contained most important for me files. The rest was added later and was not important at all. I can say I had a big luck with it.
Recovering from ext4 is possible, but not perfect. You should make regular Safepoints backups by MyCloud website. I was/am just stupid to modify system files before creating my first backup. Lesson learnt. Over 1 week of life wasted for recovering.
If somebody could please compile newest extundelete and ext4magic version on My Cloud - it would be much better. I think the ext4magic version I found doesn’t work as good as it could.
Please tell me if there are any mistakes in this post, so i’ll fix them as soon as possible.