How can I "undelete" a folder full of files on a GNU/LINUX system, where the partition is LUKS-encrypted and formatted using btrfs *?

On my Debian Stable (currently Bullseye) machine I have all my data in a LUKS-encrypted partition (except /boot). On that encrypted partition I'm using LVM to organize different volumes **, which are formatted using btrfs, where my actual data is.

So my disk setup looks as follows:

lsblk -o path,type,fstype,mountpoint 
PATH                            TYPE  FSTYPE      MOUNTPOINT
/dev/sda                        disk              
/dev/sda1                       part  ext2        /boot
/dev/sda2                       part              
/dev/sda5                       part  crypto_LUKS 
/dev/sr0                        rom               
/dev/mapper/sda5_crypt          crypt LVM2_member 
/dev/mapper/vg-root             lvm   btrfs       /
/dev/mapper/vg-var              lvm   btrfs       /var
/dev/mapper/vg-swap             lvm   swap        [SWAP]
/dev/mapper/vg-tmp              lvm   btrfs       /tmp
/dev/mapper/vg-home             lvm   btrfs       /home

In one of my partitions I accidentally deleted *** a folder (/home/USERNAME/mail/somefolderfullofimportantmessages) full of emails (text files, since I'm using the maildir-format).

While I was able to find some tools to recover lost files, they all have limitations like only working for extX-filesystems (like extundelete) or work only on images or whole partitions (like foremost) or work only on specific file types (like testdisk and photorec).

In my case, the most fitting tool was to apply the btrfs restore-command **** after fighting for quite a long time with the way it uses regex(or use the btrfs-undelete-tool from here), but with this I was only able to "re-discover" some non-deleted files in the folder path but not the deleted ones.

Why is that the case? Might this be due to the LUKS-encryption? If yes: what else should/could I have done?

* disclaimer: I had a backup and was able to restore everything from there, but let us just for the sake of the argument that this backup wouldn't exist. And yes, I know, if you don't have backups, it's your own fault.

** yes, I know, I could have used btrfs subvolumes, but the automated installer I used to install the system didn't supply that option. But on my next install I'm planning to get rid of the LVM.

*** technically speaking, I used isync/mbsync to sync my remote IMAP folder (which is out of my administrative control) with my local one. But for some reason (I didn't understand) the tool thought that my local folder was empty and therefore sent a "delete everything"-comand to the remote folder. And the next time I performed a sync the tool deleted my local folder since it assumed that my remote IMAP-folder is more up-to-date.

**** it was tricky to do that without an external boot drive. I switched to a tty, killed all processes accessing /home (using lsof /home) and then unmounted /home (after masking some systemd-services which kept accessing /home and didn't want to stop), so that I was able to perform the btrfs restore -Dv /dev/mapper/vg-home --path-regex '^/(|home(|/USERNAME(|/mail/(|/.*))))$' /tmp command (-D is --dry-run, remove that only if you are sure that you don't accidentally blow up your system).

  • 1
    if it's SSD and LUKS with allow_discards, it might be gone already. Otherwise just run something like strings -t d on the /dev/mapper/vg-home device and try to filter it for mail headers then grab data at the offsets you found. Will only work if btrfs does not compress or otherwise obfuscate raw data. Sep 29, 2021 at 12:25
  • @frostschutz: Thanks for the fast reply! In my /etc/fstab I don't have allow_discards or comp=xyz enabeled - but I'm planning to enable that in a future install. So did I get this right that if one of those options would be enabeled, a restore process using the strings -t d /dev/mapper/vg-home-approach couldn't work? And this is irrespective of the underlying LUKS-encryption?
    – n0542344
    Sep 29, 2021 at 12:42


You must log in to answer this question.

Browse other questions tagged .