Manjaro i3wm. 1 week old fresh install.
Rebooted my system today and saw that i3wm was missing its config from .i3/config and asked to create a new one. Investigated further and i am also missing multiple user files (pdf, docx, images, videos etc) from ~/Documents along with my keepass database file which has all my passwords for everything.
The only thing i can think off that created this situation is (me ofc and) a bash script i asked chatgpt to write to limit bandwith usage on an interface because i wanted to download a 100gb file overnight and without limiting it it would prevent everyone else in the house from being online efficiently. I assume that when i run it again to unset the values something went wrong. Other than that i cant think of anything else.
I run testdisk which i think found no errors and i am currently running photorec from a liveusb. I just realized that manjaro uses btrfs nowdays but i havent created a snapshot myself as i was not aware of this. Is there anything else i can do to try to recover the lost files?
Edit 1: photorec found multiple files that, size wise, seem it could be the missing ones but names and extensions do not much
Edit: While on a live usb i started getting segault on every command along with nput/output errors which makes me think it could be faulty ram.
Currently doing a mem test and the 2 first passes are clear.
Edit 2: Recovered about 70% of the lost files from this disk (still have backups elsewhere of the rest) but not the keepass.kdbx which i had no backup of.
Really curious what the hell happened here. If the memtest i plan to run overnight proves the ram is clean the only other culprits i can think of are the 870 evo ssd i bought a year ago or a power outage that happened few hours before noticing the missing files.
The first and most important rule to recover files is to not use the system in a write mode.
So best to only boot from a live medium and to mount the partition that contains the files in read only.
Although not of immediate help to you at the moment, an important lesson here is to always take backups. And test them to make sure they’ve worked.
Backintime is a very useful utility for everyday files that you might edit (and if you’re anything like me, occasionally mess up) or delete.
Due to the CoW nature of btrfs, files aren’t actually deleted, but initially only marked as obsolete. This applies to both deleted and overwritten files.
Over time, however, btrfs optimizes the data marked as obsolete and then deletes it irretrievably. This can take an indefinite (longer) amount of time. However, the more data is written and deleted, the more likely this is to happen. So if you perform an update now that involves several GB of data, your deleted files will almost certainly be gone forever.
For this reason, you should actually mount this volume only read-only until you’ve recovered your data!
Due to the CoW nature of btrfs, the metadata (file names, permissions, etc.) is also fully available in the metadata log. It’s all there, just marked as obsolete.
That’s the good news. Now for the rest.
I don’t know of any tool capable of rewinding these log files to view them at a specific point in time.
Testdisk and photorec are designed for FAT, and I don’t think they’ll be of much help with btrfs. If a tool can’t fully reconstruct the filenames from btrfs, I wouldn’t trust it at all.
P.S.
I hadnt even realized manjaro switched to btrfs from ext4, so manually i didnt enable anything related to that. I did look if there was any snapshot available but it wasnt.
Except the script was using tc and i did check line by line to see what it does before running it and seemed fine. Most likely not that.
While on live usb i started getting segfault on pretty much every command and input/output errors and browser tab crashes which made me think it could be because of faulty ram. running memtest now, first 2 passes are clear. will finish 3rd and go back to live usb
