I recently purchased a 200 GB cloud drive from http://mega.nz but now it's wrecked havoc on my local machine. To give you an idea of what happened I'll start by saying this, when I first purchased my cloud account I didn't realize that it was set to sync in both directions (will delete local file when deleted on the cloud) and instead believed falsely that it was a one way backup, local -> to cloud.
When I first set up my home directory to be backed up (151 GBs) the backup started and since I was using the Mega client there was a small icon at the bottom right corner of my desktop that would allow me to see the progress. After clicking the icon to view the progress a glitch caused the client to disappear so I had know idea if my data was being actively backed up or not. I also couldn't see any indication of an ongoing backup from their website, I could see a lot of my files and top level directories but I know there was no way 151 Gigs would have uploaded in 10 minutes. Finally I decided to just restart the whole process so I selected everything in my cloud account and then clicked deleted. Then to my horror ever file in my home directory was gone in a matter of seconds. Again, I didn't realize it would delete local files, I thought it was a backup only and I know it's mostly my fault for not reading the documentation first. I spoke with the Mega about this issue and they said everything deleted is moved to another directory, but of course only if it's successfully uploaded fist and I did this terrible thing before the upload had even been running an hour.
I ran df -h /home/garrett both before and after everything was wiped out. Now is shows 151 GBs and if memory serves me well that was also what it showed before Mega wiped out my home directory. So my question is does anyone have any idea where my data might be hiding or does anyone have any suggestions on some good Linux data recovery software? Thanks.

Dani AI

Generated

Sorry to hear this happened, — that sort of silent two‑way sync can be brutal. Quick triage now gives you the best chance: stop the sync client and avoid writing to the affected disk until you know whether the data is still recoverable.

First things to check (do these from a different machine or a live USB if you can):

  • Exit/kill the cloud client and unplug the network so it can’t continue changing anything.
  • Look for processes holding deleted files (space looks used because a process still has the file open):
sudo lsof +L1
sudo lsof | grep deleted

If you find a PID with large deleted files, copy the file descriptor before killing the process:

sudo cp /proc/<pid>/fd/<fd> /path/to/external/recovery/

If no processes are holding files, assume the filesystem entries were removed. Do not run repairs in-place. Make a block-level image of the partition first (work on the image):

sudo ddrescue /dev/sdX /media/external/image.img /media/external/image.log
# fallback:
sudo dd if=/dev/sdX of=/media/external/image.img bs=4M conv=sync,noerror

On the image, try recovery tools appropriate to your filesystem: extundelete (ext3/4) can restore inodes if the journal’s intact; TestDisk can rebuild partitions/metadata; PhotoRec does file‑carving but loses filenames. Use the tool that matches your FS type (check with lsblk -f or blkid).

Also follow ’s idea: use a disk‑usage tool to confirm where the 151GB is hiding — filelight/baobab on GUI or ncdu on the command line. Check the desktop trash (~/.local/share/Trash/files) and any local sync/cache folders before assuming irreversible loss.

If the data is business‑critical or these steps feel risky, stop and use a professional recovery service. Always work from an image and never write to the original device.

A disk usage analyser such as filelight or baobab would find visually where the GB are hiding.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.