Crouton: Recover my chroot data after accidental powerwash ?

[bformet]

Hi all, and thanks for the great crouton,

My Acer C720p was in developer mode with a chroot installed alongside.
Of course someone got to press space on developer mode scary screen... and the chromebook was powerwashed.

Is there any way to recover some data from the chroot ?

(the chroot itself was not encrypted if I remember correctly)

I tried PhotoRec to recover all possible files from the SSD, I got many eCryptfs files, is it possible that my chroot lies in one of them ?

Thanks

[DennisLfromGA]

@bformet,

Sorry but no, it got wiped when leaving/re-entering Developer mode.
It happened to me once before so I try to keep my important chroots backed up now.

-DennisL

[bformet]

Oh ok. You mean physically wiped ?

[DennisLfromGA]

@bformet,

Oh ok. You mean physically wiped ?

Well maybe '_erased_' would be a better way of putting it.
I guess it _could_ be recovered if you had the proper recovery software.

However, when leaving/re-entering Developer mode or doing a 'powerwash', the user data (/dev/sda1 on /mnt/stateful_partition) is erased.

Hope this helps,
-DennisL

[devingfx]

Hi @DennisLfromGA

I've got the exact same issue (but the powerwash was done without any consent after a crash/reboot of my Acer C720, it's a shame)

I know some "ghost" data may be still on the drive even after a format...
Do you have a starting point to try to use a recovery software to scan the ssd?

[DennisLfromGA]

I use a 'trick' to keep my crouton chroots safe from powerwashes. I run the first iteration of the 'chrx' script and resize partition 7 (ROOT-C), then I mount it and use it for crouton, crouton backups, and other things I like to archive. It won't survive a full recovery but it does survive powerwashes. After a powerwash you just have to restore your 'host-bin' files using crouton's '-b' option.

Hope this helps,
-DennisLfromGA

[devingfx]

Hope this helps,

I'm not sure to understand well, (I'm not a sysdamin, but a front dev that uses bash :) ), so could you be more precise?
First, can I try your method AFTER the powerwash occured? Otherwise it's useless...

Let me also be more precise though :)

The device is an Acer C720 (wifi) aka peppy in dev mode.
I did create a chroot with crouton install ubuntu 14 (not sure if it's 14 or 12).
And yesterday, I was working not easily because ChromeOS is laggy with more than 2 tabs since several updates now (almost since material design), and it crashed (what I'm used to also, because it crashed several times a day when having more than 10 tabs, but until yersterday it always used to start again at the state before crash, no problem) but yerterday, when booting up again, everthing was wiped, it asked me to enter 1st time install info like wifi, gmail account. What I did, and it has re-downloaded again my apps (not all) and the download folder was empty (even if I had changed the folder where to put downloads, everything is wiped out).
I tried the "enter-chroot" cmd in shell, but it was not found also...
I switched it off to avoid writing more data on the drive.

I'm not sure it's a "powerwash" but all my current work is gone as I was working and I didn't asked for an update or a powerwash, that is the reason I will never go back on ChromeOS again!!
Before throwing it by the window, I want to try a drive scan for data recovery, that I'm pretty sure is possible even I understand that I may not find something.
The question is: how to access the SSD with a recovery tool when you can't install any normal linux software? On which you can't plug a live USB linux? And can't extract the drive to read it on another device?

Please help me because my last backup was thousands of lines of code back earlier, and I've got some configs to retreive...
(and please don't say "you should make backups"... I know it :( )

[DennisLfromGA]

@devingfx,

Sorry things went sideways for you.
It's important to backup important data (~/Downloads, crouton chroots, shell scripts, etc.) on any system, maybe even more important on Chrome OS.

I probably should not have mentioned my method above, it works for me but it's not something that I would suggest for everyone.

that is the reason I will never go back on ChromeOS again!!

Hate to see you give up but I understand.

-DennisLfromGA

[darethehair]

@devingfx:

I cannot offer you any unrealistic hope that your work can be recovered, but perhaps I can add a few comments to the situation...

From my own experiences -- including the C720 -- I know that it is possible to remove the internal SSD (since it is replaceable), and to temporarily (if you want) insert it into a tiny compatible M.2 SSD USB 3.0 enclosure -- which you can then plug into another PC while running Linux (for example) -- treating it just like any other multi-partitioned external drive. In fact, this is the method that I had to use to get my desired Linux distro initially onto my C740 Chromebook (different CPU than the C720). This would make it possible to check the contents to look for your work before giving up entirely.

I have been 'burned' myself in the past by having my Linux stuff on the internal SSD -- for me it was another partition, and for you it was crouton on the normal partitions. For this and other reasons, I now have my Linux stuff on a separate removable tiny SanDisk Ultra Fit USB 3.0 dongle. If you continue to use your Chromebook for Linux development work, you might want to try that approach instead. I was able to both run a regular Linux distro, as well as storing my crouton Linux doing it this way.

[devingfx]

@DennisLfromGA thank you adding more shame than I had. Hating myself already. Especially after asking you to don't answer that!
🥇

Do you confirm that there is no way to install/script a tool to scan internal SSD directly on the device in a crosh term? A bit like crouton itself, or a magical keyboard combo to boot the beast as USB slave or something?

I guest the 'chrx' thing you gave me will touch partition and make less likely to recover data afterward right?
Also same question, if I reinstall crouton + a lightweigh minimal img could I try to scan the rest of the drive for file to backup on USB drive?
Even I loose some old data at the begining of the drive (wash + config/apps redownload already burned that part)
_(I may accomodate as it's better to recover 10% of data instead of 0, and I'm pretty sure old stuff is backuped and data I need to find should be at the end of memory because more recent and the SSD was 90% full)_

Edit: after further reading: Does chrx can create a bootable img on a USB key?
The docs say :
-t TARGETDISK target disk (/dev/mmcblk1, /dev/sdb, etc) []
If I use the mounted /media/removable/lexar ?

---

Thank you @darethehair for your lil' hope still ! :)
I gonna try this adventure...

May you precise for an hardware noob like me, the adaptor spec I need to buy please?
What is " compatible M2 " ? Is it physical plug type to care about or SSD version (speed or whatever) ?
_(a link to a sample asset would be a great help ^^)_
Do I have to care about something special when opening up the beast brain? (static electricity, or stuff like that?)
And then, any recovery tool chain to suggest? I've got a Win10 PC and Raspberry Pis (debian arm) to work with...

[DennisLfromGA]

@devingfx,

(and please don't say "you should make backups"... I know it :( )

Sorry, I missed that last request, I guess I didn't read it all - my bad.

thank you adding more shame than I had.

That was not my intent.
I'll refrain from making any more comments or trying to provide any other answers.

-DennisLfromGA

[darethehair]

@devingfx:

Your C720 SSD is an 'M.2'-style solid state device. More specifically, it is a 2242 (22mm wide x 42mm deep) model. It is also removable, and you could replace it by purchasing a 'compatible' model on Amazon or whatever (e.g. I replaced one of my own with a 128GB SSD just to get more space). In your case, though, you also have the ability to put it into an USB 3.0 'enclosure' and connect it to a running Linux session on another computer -- just like you could plug in any 3.5" regular mechanical 'spinning disk' drive (if you know what I mean). There are lots of these things available on eBay (where I got mine), but you can check Amazon as well (look for 'm.2 ssd enclosure'). Here is one that looks similar to the one I bought:

https://www.amazon.com/ELUTENG-Adapter-SuperSpeed-Enclosure-Samsung/dp/B06Y5N428V/ref=sr_1_8?ie=UTF8&qid=1518375794&sr=8-8&keywords=m.2+ssd+enclosure

I have opened C720's and C740's and other Chromebooks/boxes many times. Lots of screws to remove, but easily done. Yes, I suppose good 'grounding' is a good idea, but this isn't as scary as you might think. You might want to temporarily disconnect the battery as well. On the C720/C720, removing the SSD is very easy -- there is a single screw that holds the SSD in place, and after it is removed you just slide/unplug it.

I have a webpage detailing my Linux adventures on my C720/C740 Chromebooks, and this image from that page shows the SSD and screw on the far right side (labelled 'Kingston').

http://darethehair.net/c720p_inside_1920x1440_labels_white.JPG

In any case, I think this part is the pretty easy -- what I cannot tell you is exactly where to look in the partitions for your stuff -- but it is still there, you should be able to find it. Maybe you can search for a known file name? Just make sure that you only 'read' the SSD, and don't 'write' to it, or accidentally re-format it :)

I am not suggesting any sort of specialized 'recovery' -- I am simply suggesting that (if un-encrypted) that you find your missing files, and then copy them to a safe place on the Linux computer you are using to interrogate the drive. Know what I mean?

I don't think your 'Windows' 10 PC will be of any use -- since the SSD is formatted with a Linux file system and probably won't be recognized (?) -- unless you use it to temporarily boot Linux on it. Your Pi might work, even though that seems a bit award to me as an approach -- and perhaps a bit slow as well. As a 20+ year Linux user, I encourage you to install a full/fresh Linux on a regular PC and enjoy its full potential! :) I love my Chrome devices -- but as you can see from my webpage, I take full advantage of the fact that I can also run my favorite Linux distro on those machines -- and have the best of two worlds.

P.S. For what its worth, here is the webpage that I was also alluding to:

http://darethehair.net/chromeos.html

P.P.S. There are lots of videos on YouTube that show people how to open their Chromebooks to replace batteries, SSDs, and remove the 'write protect screw' that then allows them to more easily boot alternate OS's like Linux. In your case, it would just give you some comfort in seeing how easy it is to do this.

[devingfx]

Hi !
I never view your answer, you're awesome!
I finally have to try tihs way, I gonna buy this one can your confirm it's enough ? (I dont need case, the drive will go back in the C720P after )

[devingfx]

Hi again!
I managed to get my SSD out of the chromebook with a USB adapter, I scanned the drive with PhotoRec (testdisk package) under a Debian (Raspbian on a RaspeberryPi) and I get a lot of 426876266.eCryptfs files...
So I suppose I had a crypted FS ... :(
Is there a way to decrypt that data by generating some keys for decryption from the ChromeOS credential as I'm the owner and I know the cred. I used to login?

[devingfx]

Hi again!
I managed to get my SSD out of the Chromebook with a USB adapater, I scanned the drive with photorc from testdisk package on a Debian (Raspbian on a RaspberryPi) and I get a lot f68718616.eCryptfs ...
I assume I had a crypted fs... :(
I there a way to decrypt that data somehow? I may gen the good algo's key from my ChomeOS credential?

[DJShayde-crypto]

whats up, i have some experience with crosh and some of the commands, but i need help. i accidentally power washed my Chromebook, and all my files have been erased. Idk if there is a way to restore my Chromebook to its original state and have all my files, I've never ran into this problem. and if there isnt any way to restore it, then that's fine.