I've burned a portable Ubuntu ISO onto a USB and booted it up on Macbook Pro 2017. I've selected the "try Ubuntu" option.
After using it for ~36 hours, I click "Suspend". Now, when I boot up the laptop again into Ubuntu and selected the "try Ubuntu" option, I see that it's a brand new copy—my 6 files on the desktop are no longer there.
What happened? How can I recover the lost data?
It's that simple, really. If you cared about the data in those files you should not have chosen a session that is advertised as "not doing any changes to your computer".
Or, at least, you should have saved them in an external drive.
RAM is a volatile kind of memory. Do not believe those who talk about recovering data from it after the computer has been switched off. It is not possible, the so called "cold boot attack" is basically impossible to put in place unless you happen to carry around some liquid nitrogen and apply it seconds after the fact. Then maybe it could work.
No DFIR expert nor data recovery company can do anything about your RAM after it has been turned off.
Recreate those files from scratch.
Whenever you run a live CD, everything you do is saved in memory but not onto your actual hard drive. It might be possible to recover the information from your memory if you're really lucky and have access to some good forensics tools but in all likelihood, your data is gone. If you want to use Ubuntu on a live cd and save your data, you must save it to some storage like a USB drive or your hard drive where your Mac install is located.
If you really like Ubuntu, I think Macs have something called bootcamp that allows you to partition your hard drive and dual boot Mac OS and Ubuntu. I'm not sure if Mac support it, but you could also install Ubuntu to a flash drive and boot from that which will allow you to preserve data.
