2mo ago

How stupidly easy file recovery is on Linux

Today had some important markdown file that accidentally deleted on my SSD and had to go over the recovery of it.

All I did was this:

run sudo systemctl status fstrim.timer to check how often TRIM runs on my system (apparently it runs weekly and the next scheduled run was in 3 days)

run sudo pacman -S testdisk

run sudo photorec

choose the correct partition where the files were deleted

choose filesystem type (ext4)

choose a destination folder where to save recovered files

start recovery

10-15 minutes and it's done.

open nvim in parent folder and grep for content in the file that I remember adding today

That's it - the whole process was so fast. No googling through 10 different sites with their shitty flashy UIs promising "free recovery," wondering whether this is even trustworthy to install on your machine, dealing with installers that'll sneak in annoying software if you click too fast, only to have them ask for payment later. No navigating complex GUIs either.

I was so thankful for this I actually donated to the maintainers of the software. Software done right.

You're viewing a single thread.

53 comments

Congratz on recovering the important file. And thanks for sharing your tips and experience. Good to know in case of an accident. In general I advice you to do regular backup of changing files (or at least once if it doesn't change), especially for important and small files like Markdown.
I would also recommend not to install or use the system, and try to recover from a live boot rescue disk or usb stick instead. This will minimize the risk of losing the file. Even if trim didn't run and delete the data, you could accidentally overwrite parts of it while using your system (in example while installing software or when using your browser). EDIT: When I think about it, I am actually not sure if this is true for SSDs. This is just a habit of me from old magnetic drives. I think the used data will not be overwritten, until trim runs, right?
- AFAIK the blocks get marked as "free space" and can be potentially overwritten by new stuff. TRIM guarantees those blocks will be wiped at hardware level. I thought about booting from a live USB but eventually decided to try it out normally.
  It was interesting to find out that TRIM runs once a week for me, I thought it runs almost continuously and not periodically? Is this common perhaps someone knows?
  
  It was interesting to find out that TRIM runs once a week for me, I thought it runs almost continuously and not periodically? Is this common perhaps someone knows?
  Oh, this is common as far as I know. You don't want to run TRIM too often, because excessive delete/rewrite will tear down your drive faster. There is no perfect setup and might be different for specialized use cases. A weekly TRIM is absolutely normal. In some occasions after lots of lots Gigabytes write and delete, I start the process sudo fstrim -va manually myself too (it figures out all SSDs that can be trimmed). This is something you should not need to do, just make sure you have plenty of space left (personal limit in my mind is 25% free space).
  For me its weekly too:
  bash
  
  $ cat /etc/systemd/system/timers.target.wants/fstrim.timer [Unit] Description=Discard unused filesystem blocks once a week Documentation=man:fstrim ConditionVirtualization=!container ConditionPathExists=!/etc/initrd-release [Timer] OnCalendar=weekly AccuracySec=1h Persistent=true RandomizedDelaySec=100min [Install] WantedBy=timers.target
  
  Ah I see thanks for the info. I was not even aware you can manually run it but I suppose it makes sense.

53 comments