Librem 14 loses all its files?

Hardware Librem 14
1

I was just running the latest software update (using Terminal) for one of my family’s Librem 14s. It was unplugged but had been plugged in continuously charging for hours, until a few minutes before. When I had completed the update the machine spontaneously shut down. When I tried to boot up again, I got a Grub prompt and the machine would not boot; it said the o/s kernel had to be loaded. Running ls commands in Grub revealed that while there were several partitions on the disk, every one of them showed as empty or ‘unknown file system’, including the one that was set as root for booting purposes.

I was able to boot up with a flash drive and reinstall PureOS. However, all the data that was on the laptop is apparently gone.

  1. How is this even possible?
  2. Is there any way to recover the data? (I did NOT reformat the drive when reinstalling PureOS, I used an existing partition).

Interested in anyone’s thoughts about this or if anybody has had a similar experience.
thanks, Eric T

1 Like
2

If you cared a lot about the files on the drive, I think overwriting them with a new system install is an extremely unwise action.

Well, PureOS uses a lot of stuff from Debian (similar to other Linux distributions). So, if you instruct the live boot USB to overwrite the existing disk, it would do the same stuff as other distributions. And that would probably mean erasing what is there, or else installing in place maybe if the distro can do that. I haven’t personally tried doing that with PureOS because it wouldn’t make any sense.

You need to be aware of what filesystem your hard drive is using and how that is working if you’re going to “reinstall the OS in place” and act as if old files would be retained.

In particular, unlike a lot of other Linux distributions, PureOS encourages a LUKS encrypted hard drive. So if you have to type a password before the login password, this is why.

That first password to decrypt the disk turns “unknown file” gobbletygook on an encrypted partition into data one can actually boot from.

So from grub or from your PureOS live CD, if I was in your shoes, before writing to the disk I would have used cryptsetup command line tool to mount the “unknown file” AND SEE IF MY FILES STILL EXIST.

You could envision a flow chart based on that:

  • If yes, back them up, then reinstall system
  • If no, hard drive contents are damaged and everything is at risk from using the drive AT ALL. If your life depends on file recovery in this second stage, research advanced file recovery online where you run a program to seek through a corrupted file system that has started to lose the files, and see if those really smart tools can find bits and pieces of your data and bring it back. Sometimes this finds images without finding their file names, etc, really serious bits in pieces

However, it sounds like you did not perform this initial investigation and wrote over the (encrypted?) file system with a new one. If you did not enter the old LUKS password during that install process, then the only logical outcome is that you wrote it over without allowing the system to be aware of your previous files.

In such case, recovery at that point becomes painful questions about how LUKS works, whether you forced yourself into that “no” case listed above, or whether your “in place” wizard was smart enough to put your LUKS encrypted “unknown file” data somewhere (I doubt it!).

As a random passerby writing from bed on his Librem 5, my primary advice is this:

If you really care about your files, stop writing to the drive until you understand more about what happened, what you did, and if any data is left.

Edit: And booting from the drive always writes to the drive, so when I suggest not writing to the drive, that also means only booting from USB.

(Until you understand what is lost and what is there. I certainly don’t yet from my first time reading your post.)

1 Like
3

Restore the data from your last good scheduled automatic backup.

2 Likes
4

Using digital forensic tools like Autopsy:

5

Thanks for the response. Obviously I have a lot to learn here. But even before I reinstalled, the boot partition showed as completely empty–no ‘unknown file system’, no nothing.

1 Like
6

Thanks, there is some backup but running it on a schedule would of course be better.

2 Likes
7

Thanks, will look into it.

1 Like
8

When you “boot up with a flash drive” the active boot partition is part of the flash drive, not the previous actual disk. You would probably needed to have mounted the actual disk to see the files. One could have done that with gparted or disks from the live boot from the flash drive. Too late now … but it’s not a bad idea to practice these things.

When you did a re-install from the flash drive … it found the actual storage space, it reformatted that for the install, and then did a clean-write to that newly formatted partition. While it might technically possible that one could restore a few files from a reformatted and overwritten filesystem, it’s unlikely anything meaningful can be recovered.

1 Like