How can I "undelete" a folder full of files on a
GNU/LINUX system, where the partition is
LUKS-encrypted and formatted using
Debian Stable (currently Bullseye) machine I have all my data in a
LUKS-encrypted partition (except
/boot). On that encrypted partition I'm using LVM to organize different volumes
**, which are formatted using btrfs, where my actual data is.
So my disk setup looks as follows:
lsblk -o path,type,fstype,mountpoint PATH TYPE FSTYPE MOUNTPOINT /dev/sda disk /dev/sda1 part ext2 /boot /dev/sda2 part /dev/sda5 part crypto_LUKS /dev/sr0 rom /dev/mapper/sda5_crypt crypt LVM2_member /dev/mapper/vg-root lvm btrfs / /dev/mapper/vg-var lvm btrfs /var /dev/mapper/vg-swap lvm swap [SWAP] /dev/mapper/vg-tmp lvm btrfs /tmp /dev/mapper/vg-home lvm btrfs /home
In one of my partitions I accidentally deleted
*** a folder (
/home/USERNAME/mail/somefolderfullofimportantmessages) full of emails (text files, since I'm using the
While I was able to find some tools to recover lost files, they all have limitations like only working for
extundelete) or work only on images or whole partitions (like
foremost) or work only on specific file types (like
In my case, the most fitting tool was to apply the
**** after fighting for quite a long time with the way it uses
regex(or use the
btrfs-undelete-tool from here), but with this I was only able to "re-discover" some non-deleted files in the folder path but not the deleted ones.
Why is that the case? Might this be due to the
LUKS-encryption? If yes: what else should/could I have done?
* disclaimer: I had a backup and was able to restore everything from there, but let us just for the sake of the argument that this backup wouldn't exist. And yes, I know, if you don't have backups, it's your own fault.
** yes, I know, I could have used
btrfs subvolumes, but the automated installer I used to install the system didn't supply that option. But on my next install I'm planning to get rid of the
*** technically speaking, I used
isync/mbsync to sync my remote
IMAP folder (which is out of my administrative control) with my local one.
But for some reason (I didn't understand) the tool thought that my local folder was empty and therefore sent a "delete everything"-comand to the remote folder.
And the next time I performed a sync the tool deleted my local folder since it assumed that my remote
IMAP-folder is more up-to-date.
**** it was tricky to do that without an external boot drive. I switched to a
tty, killed all processes accessing
lsof /home) and then unmounted
/home (after masking some
systemd-services which kept accessing
/home and didn't want to stop), so that I was able to perform the
btrfs restore -Dv /dev/mapper/vg-home --path-regex '^/(|home(|/USERNAME(|/mail/(|/.*))))$' /tmp command (
--dry-run, remove that only if you are sure that you don't accidentally blow up your system).