Help Deleted image files while copying(moving) with usb cable

[Sven Nilsen]

Hi,
i've got to confess doing something "not-so-smart"TM.

I connected my CAT S60 phone to my linux laptop with usb cable.
Selected a folder on the phone containing several subfolders of images in linux explorer and MOVED it onto the laptop.
Done for backup/freeing space purposes. For whatever reason, the move went wrong, and the only thing gotten moved are the empty subfolders, without images. They are gone on the phone, and no images got moved to the laptop.

Disk space usage on the phone tells me they have not been freed on the android file system, but they are not present in the folder they were in either. Floating around in cyberspace as lost clusters presumably.
How can i try to recover them? My phone is not rooted and is not yet rootable CAT S60.

 

[svim]

... For whatever reason, the move went wrong, .....

That's a little too cryptic to even take a guess at what happened. Was there an error message? Did the Linux explorer (another very obscure reference that needs clarifying) that you used crash? Did you cancel the move process itself while it was still in progress?

Also, have you used a file manager app on your S60 to actually check if those files/folders are indeed there or not?

 

[Sven Nilsen]

Ok, i'll be more specific. I used Nautilus, the standard file manager/browser in ubuntu (behaves like windows explorer in win7/8/10) to cut/paste the file folder from the phone storage to the laptop. The process did complete, but when moving about 4gb of data, 10 seconds over usb is a bit fast. Turns out only the subfolders were moved, and not the contents. Why the files were "deleted"/unindexed on the phone storage before they were actually moved is beyond me.
I SHOULD have copied, checked, and deleted manually, but since nothing hardly ever goes wrong one tends to get lazy....

Anyways, a standard "drag'n drop" move of files had them removed, and the space they took is still occupied.
I have used "file manager HD" on the phone to search, including for hidden files. Gone.
I also used DiskDigger to have a go, but since my phone is not rooted i get only a file scan and not file system scan, ie will only show files that are present but hidden, eg in cache folders or likewise. These are not indexed by the system anymore, but still taking up space on the phone storage. (Had 3gb free, still have 3gb free.)

Will try to get the phone storage mounted through linux directly if possible, to take a full backup and do forensics. I have software for this, but havent worked with file systems where i could not just "plug it in" to my sata/ide cable before.

If i get a lowlevel backup of the complete partition, i figure i'm home.

 

[Dannydet]

I always copy things, never move because of this situation.
That way everything is recoverable.

 

[svim]

Will try to get the phone storage mounted through linux directly if possible, to take a full backup and do forensics. I have software for this, but havent worked with file systems where i could not just "plug it in" to my sata/ide cable before.

If i get a lowlevel backup of the complete partition, i figure i'm home.

Note that you're most likely dealing with an encrypted storage media on you S60 so always keep that in mind. At one time I had good luck using the testdisk/photorec utility but that was back in the pre-KitKat days on un-encrypted phones.

 

[svim]

Just for future reference, maybe avoid using Nautilus on your PC to 'pull' files over and instead use a file manager app installed on your S60 to 'push' files to your PC. This way your phone (its OS and app) is managing the file transfers and not the remote connected PC (using its OS and application). I like the Ghost Commander app but there are plenty of other good file manager apps that include local networking capabilities.
https://play.google.com/store/apps/details?id=com.ghostsq.commander&hl=en_US
or take a look at 'Explorer'
https://play.google.com/store/apps/details?id=com.speedsoftware.explorer
Another, different option is to use something like KDE Connect (you need to have both the KDE Connect app on your phone and on your PC):
https://play.google.com/store/apps/details?id=org.kde.kdeconnect_tp&hl=en_US
of since you're running Ubuntu you might prefer GSConnect instead:
https://www.linuxuprising.com/2018/04/integrate-your-android-phone-with-gnome.html
I've tried using KDE Connect and it works out well, never tried GSConnect. But mostly I rely upon AirDroid, a WiFi based utility, that only requires the AirDroid app installed on my phone and then require only a web browser on the target computer so it does not involve any program installation/configuration.
https://play.google.com/store/apps/details?id=com.sand.airdroid&hl=en_US

 

[Sven Nilsen]

Thanks for the tips.

Btw, i had any number of options for copying, Two nas servers at home, andSMB on the phone for copying to nas/net shares, file server on the phone etc, but due to being at work and using the phone camera to document a test procedure and putting the pictures directly into the report on my laptop, the usb cable was out. And in a moment of sheer stupidity i decided to pull off some other space hogging directories while writing the report since the phone was connected anyway.

At the moment i use testdisk and photorec on the memory card, since those files were present on the card not too long ago. Looks like i get some of the files back at least.

No luck on getting a binary dump of the phone memory so far. Trying "Minitool mobile recovery for android" on the other pc as i type, it's been sitting at "analyzing device 99%" for an hour now. I guess being under the weather from overwork is not the best time to make hastily decisions about where to move my data.

Any suggestions on getting a full dump of an unrooted phone? The cat S60 was not rootable last i checked. All my other devices are rooted.

And for the record, lesson learnt. Seems i do these types of mistakes about every five years.....

 

[Deleted User]

It doesn't surprise me that your data got corrupted during copying of these files.
Different situation, but I've noticed when using Ubuntu to copy files from the HD to an SD card, it's produced unpredictable results when I removed the SD card. You may think the copying process has finished, but really it hasn't. I suspected there was some buffering going on as the drivers tried to keep in sync with each other.
When unmounting an attached storage device, notice the delay from when you click the unmount icon, and the system telling you it's ok to remove the device? That's because until then, the filesystem is being synced.
If anyone recalls the old days of Unix, the standard shutdown commands were "sync; sync; halt". That was to really make sure the filesystem was in a good state. Anyway, I digress. But unmounting a filesystem during sync is very likely to corrupt the data.
Incidentally, the way to fix a corrupted Unix/Linux filesystem is to use the fsck command. It's not guaranteed to recover your data though, just fix inconsistencies in the inode table. Maybe Android has an equivalent command.

 

[priscillaahoward120495]

Hi,
i've got to confess doing something "not-so-smart"TM.

I connected my CAT S60 phone to my linux laptop with usb cable.
Selected a folder on the phone containing several subfolders of images in linux explorer and MOVED it onto the laptop.
Done for backup/freeing space purposes. For whatever reason, the move went wrong, and the only thing gotten moved are the empty subfolders, without images. They are gone on the phone, and no images got moved to the laptop.

Disk space usage on the phone tells me they have not been freed on the android file system, but they are not present in the folder they were in either. Floating around in cyberspace as lost clusters presumably.
How can i try to recover them? My phone is not rooted and is not yet rootable CAT S60.

I found the same issue. What is the best answer?

 

[mikedt]

A few more details needed I think, in order to possibly give a "best answer". Like what exactly is "Linux explorer"? What distro are you using, version, desktop, KDE, Gnome, etc.? How is the phone connected to the computer, like is a mounted storage device or using MTP or something else? One thought, how well is MTP(a proprietary Microsoft protocol) implemented in your particular Linux OS, is it stable, beta, experimental, etc.? And if it fell over before the file move was complete, that could lose data.

But usually for important stuff, you really should be using COPY and not MOVE, basically to ensure the files are safely transferred and stored before they're deleted from the phone.

 

[Dannydet]

I always copy things, never move because of this situation.
That way everything is recoverable.