Recovering data from a docker bind mount

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
p4block
Posts: 1
Joined: 09 Jun 2025, 19:16

Recovering data from a docker bind mount

#1 Post by p4block »

I recently ran

Code: Select all

rm -rf /opt/teslamate/*
This has been widely regarded as a bad move.

The important part is this postgres database, sadly not a single file, like sqlite, so photorec is of little help I think.

Code: Select all

  
  database:
    image: postgres:15
    restart: always
    environment:
      - POSTGRES_USER=${TM_DB_USER}
      - POSTGRES_PASSWORD=${TM_DB_PASS}
      - POSTGRES_DB=${TM_DB_NAME}
    volumes:
      - /opt/teslamate/db:/var/lib/postgresql/data

The system is a VPS with a regular ext4 partition in /dev/sda3. I instantly shut down the system.

Now, testdisk to the rescue from a live ISO, I see if I can undelete files, and the /opt/teslamate folder is empty.

However, I can undelete massive amounts of data from the drive, i.e. several GB of stuff I deleted years ago. I can bring back a lot of deleted containers in /var/lib/docker/overlay2, including several postgres container versions.

But nowhere I can find the files that were bind mounted via docker to a few subolders in /opt/, they seem to be completely gone.

Docker's bind mount is a bit cursed as it doesn't show properly in `mount` and I've been trying to find a place where the files/inodes truly were stored (something like /var/***/var/lib/postgresql/data) to no avail so far.

ext4magic segfaults too upon recovering 20 or so random files, so that's not good either

I will post my findings if I find the key to undelete these files, but it's not looking like I will be able to do so.

I'm open to any ideas in the meantime :D

EDIT:
I swapped the live system for NixOS, as it seems like Debian 12 has a broken ext4magic.
With it I could print all "undeleteable files" and for some unknown reason, the /opt/teslamate is indeed nowhere to be found. I can undelete files from another postgres instance I deleted many years ago. I guess newer rm -rf versions really, really make sure files are gone.
Post Reply