0

I had a usb with my project files and had a problem arose intermittently with remounting the usb. The mount command said it was a mftmirr mismatch due to the ntfs file type so I decided to change the filesystem front end to with mkfs.ext4 . Now my flashdrive contents are entirely gone. On further investigation I can confirm that mkfs does not delete the files so my question is what could have caused this?

2 Answers 2

2

mkfs commands format the target drive with a new filesystem. Formatting creates an empty filesystem that contains no files. That's the purpose of formatting.

Stop using that drive now and remount it read-only. If you're lucky, you'll be able to recover your files using photorec or similar software.

4
  • If by empty you mean that it deleted the files it certainly does not.
    – Chris Hoy
    Commented Nov 5, 2020 at 10:53
  • 1
    @ChrisHoy Define "deleted". You could argue that as long as file's contents are somewhere on the disk the file isn't deleted. It's not a useful definition though. The file is not reachable, doesn't have a name, location, metadata etc. It's just a sequence of bytes somewhere in the middle of the disk that happens to match what was in the file. Deleting files in the file manager also doesn't "delete" them in this sense, the contents are still left on the disk - just not usable though the filesystem.
    – gronostaj
    Commented Nov 5, 2020 at 11:05
  • I suppose that the most basic definition would be the inverse stateof having any type of data. Effectively that would be the same as turning "off" the values of data. In this regard I believe the question directly reflects the semantics of such systems.
    – Chris Hoy
    Commented Nov 6, 2020 at 11:08
  • @ChrisHoy Your concept of how data is stored in computer systems seems to be very simplistic. What constitutes "having any type of data"? No filesystem I'm aware of, and certainly not any common one, erases files when they are deleted. Is a deleted, but not erased file "deleted" in your sense of this word? And the opposite extreme, what if a file exists in the filesystem but it's heavily fragmented into tiny pieces scattered across entire disk? Is it "deleted" if you can't simply tell where the file starts and ends on disk?
    – gronostaj
    Commented Nov 6, 2020 at 11:22
1

mkfs does not explicitly delete files. In the target device it creates structures specific to the desired filesystem, not taking care of anything that is already there. The new filesystem is created empty.

In effect old files disappear. It's true that unless the new filesystem is created with an option that clears the entire device (e.g. writes zeros into space now marked as unused), the old data and metadata is partially there. Still there is no straightforward way to get to the old data because the most basic structures that identified the old filesystem have been overwritten with the most basic structures of the new filesystem. The latter say there's a new filesystem and it's empty. In such situation no OS searches for remnants of possible old filesystem(s), so the files seem gone.

Still with the right tools whose job is to search for remnants sometimes you can get some data back. To maximize your chances you should stop writing to the new filesystem immediately. Unmount it. If you need it mounted, mount it read-only.

Changing one filesystem into another in place and without losing files is called conversion. Tools from the mkfs family don't do this. In general there is no way to convert from one arbitrary filesystem to another arbitrary filesystem. There are tools to convert from some specific filesystem type to another specific type. I know no tool that allows conversion from NTFS to ext4. As these are very different, I would be surprised if such tool existed. A general way to change the filesystem type is to copy the data elsewhere, create a new empty filesystem (like you did), copy the data back.

Even if the new type is the same as the old one, mkfs does not fix the old filesystem. Its job is to create an empty filesystem anew. Fixing a filesystem requires another tool (starting with the fsck family), but Linux is not well equipped to fix NTFS. I think in your case it's too late to fix the old filesystem as a whole. You should concentrate on recovering files.

2
  • This is an excellent response. It would make much more sense that while not deleted per se it would transposed the file system across the existing format and therefore backtrack software would make sense in this regard. Thank you.
    – Chris Hoy
    Commented Nov 5, 2020 at 10:50
  • @ChrisHoy Can you explain what you mean by "transposed" and "backtrack" here?
    – gronostaj
    Commented Nov 5, 2020 at 11:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .