I was trying to set up a family member up with Linux as a windows replacement. I installed MX Linux xfce on their laptop with separate “/” and “/home” partitions.
Through a comedy of errors, the following occurred:
- On day one, Timeshift was configured to take weekly snapshots of the system files AND their user home folder.
- The initial timeshift snapshot was begun, and then cancelled when they discovered that home files aren’t the intended target, but they noticed growing snapshot files, indicating the cancelation wasn’t complete.
- NCDU was used to remove the files in /home/timeshift
- The family member’s only copies of three days of paid work in a writing program called Bibisco (Java app) disappeared after reboot
The system was rebooted twice before the cause was discovered and shutdown with minimal (5min) use.
I’ve never done any ext4 data recovery, but the tools in Kali seem geared toward common and known filetypes (pdf, jpg, etc).
Should I be looking to restore the timeshift files, or the writing documents (with .bibisco2 file extensions)?
Is this a lost cause?
I highly recommend testdisk, but definitely shut down the machine and use another disk (USB drive?) To boot and avoid mounting the disk that may have your files at all. mount read only if you have to. Save the recovered files to a different drive as well, which can be the same USB drive you’re using for recovery. If testdisk doesn’t show the files (in my experience, for drives that have significant free space they will almost certainly be there) you could try photorec, the companion app that does signature based file searches.