System restore tool for Linux. Creates filesystem snapshots using rsync+hardlinks, or BTRFS snapshots. Supports scheduled snapshots, multiple backup levels, and exclude filters. Snapshots can be restored while system is running or from Live CD/USB.
1.53k
stars
75
forks
source link
[Question] Is it possible to fix data loss due to an interrupted Timeshift restore? #280
TLDR:
I interrupted a Timeshift restore and now the partition is almost empty. Is it possible to fix this besides trying to recover the data with tools?
Hello,
I have lost all files on my SSD after canceling a Timeshift restore.
Before I start trying to recover the files, I want to understand what Timeshift did and maybe find an easier way to recover the files.
What happened:
I wanted to restore the system to a month old snapshot.
Shortly before, I had changed an excluded directory from "/home/user/" to "/home/" in the settings and also tried to create a snapshot of the current system, which failed because the volume group for Timeshift had no free space left.
After starting the restore to the older snapshot, I left the laptop for 7-10 minutes. When I came back, I saw that Timeshift waa deleting files in /home/user/.config/.
I thought that Timeshift does not normally touch the home directory and that this must be some kind of error. I canceled the restore process with STRG-C to prevent further damage and rebooted. The system no longer boots.
What I have tried:
I mounted nvme2, nvme5 and nvme6 on a Linux live system to inspect the damage.
The entire Linux partition is almost empty, except for a few folders and files in root.
The command 'df -H' tells me that only 1% of the partition is used.
The current state:
The system is apparently no longer bootable. I get a black screen after the BIOS splash screen.
The BIOS boot menu does not help either.
The SSD is partitioned as follows:
nvme1 - related to Windows
nvme2 - EFI
nvme3 - Windows main partition
nvme4 - related to Windows
nvme5 - boot
nvme6 - Arch Linux (encrypted LVM, ext4)
(I am only interested in nvme6)
Nvme6 has one volume group with 3 logical volumes: root, home and timeshift.
timeshift was the place, where the snapshots were stored.
All volume groups are empty, except for 80MB in root.
Timeshift also touched nvme2 and nvme5, because nvme2 is empty and nvme5 has only a few files.
My question:
I cannot imagine that Timeshift deleted all the files one by one. Otherwise the partition would not be empty and there would be many more files left
It rather looks like it deleted one or several important hardlinks (?), so that the system cannot see the files anymore.
Is this because that Timeshift uses rsync and rsync deletes files before transferring them?
TLDR: I interrupted a Timeshift restore and now the partition is almost empty. Is it possible to fix this besides trying to recover the data with tools?
Hello,
I have lost all files on my SSD after canceling a Timeshift restore. Before I start trying to recover the files, I want to understand what Timeshift did and maybe find an easier way to recover the files.
What happened: I wanted to restore the system to a month old snapshot. Shortly before, I had changed an excluded directory from "/home/user/" to "/home/" in the settings and also tried to create a snapshot of the current system, which failed because the volume group for Timeshift had no free space left.
After starting the restore to the older snapshot, I left the laptop for 7-10 minutes. When I came back, I saw that Timeshift waa deleting files in /home/user/.config/. I thought that Timeshift does not normally touch the home directory and that this must be some kind of error. I canceled the restore process with STRG-C to prevent further damage and rebooted. The system no longer boots.
What I have tried: I mounted nvme2, nvme5 and nvme6 on a Linux live system to inspect the damage. The entire Linux partition is almost empty, except for a few folders and files in root. The command 'df -H' tells me that only 1% of the partition is used.
The current state: The system is apparently no longer bootable. I get a black screen after the BIOS splash screen. The BIOS boot menu does not help either.
The SSD is partitioned as follows:
Nvme6 has one volume group with 3 logical volumes: root, home and timeshift. timeshift was the place, where the snapshots were stored. All volume groups are empty, except for 80MB in root. Timeshift also touched nvme2 and nvme5, because nvme2 is empty and nvme5 has only a few files.
My question: I cannot imagine that Timeshift deleted all the files one by one. Otherwise the partition would not be empty and there would be many more files left It rather looks like it deleted one or several important hardlinks (?), so that the system cannot see the files anymore. Is this because that Timeshift uses rsync and rsync deletes files before transferring them?
Thank you.