After doing some experiments and whatnot I ended up with my / and Timeshift partitions both completely full. Later when I had to run a Timeshift restore, I knew something was wrong when Timeshift was complaining about some "rsync delete_file not permitted ... unlink ...".
After restarting, the system wouldn't boot, not even show in UEFI boot options. To my surprise my /, /home and Timeshift partitions were all empty! All my system files just disappeared due to some dark magic. Including the backups.
Only things remaining are two very early Timeshift snapshots from ~9 months ago.
No idea how this could have happened. Maybe previous headers might have been restored somehow? Sudden incompatibility with LUKS2 argon2id?
It's not the ext4 partitions that disappeared, it's the data on them. So the files might still be on the disk I just don't know how to recover them without risking overwriting the empty space they left after themselves.
What I've tried (running on the partitions from a live Ubuntu from USB):
I tried Gparted's recover data option but it didn't find anything useful.
I tried recovering superblocks with e2fsck, they're all the same.
I had minor success trying PhotoRec, which recover files from / almost the original size of the /, but the files are just gibberish with random names and folder structure.
gpart, testdisk, scalpel and extundelete didn't help either (at least the way I've tried them with my limited knowledge).
Background:
I was backing up /home as well, but have omitted /home recently. I also omitted backing up flatpak folder because it was eating up a lot of space. I was also running Docker (some people suggest Docker+Timeshift can cause problems).
Anyone has any lead on how to bring my system back?
After restarting, the system wouldn't boot, not even show in UEFI boot options. To my surprise my /, /home and Timeshift partitions were all empty! All my system files just disappeared due to some dark magic. Including the backups.
Only things remaining are two very early Timeshift snapshots from ~9 months ago.
No idea how this could have happened. Maybe previous headers might have been restored somehow? Sudden incompatibility with LUKS2 argon2id?
It's not the ext4 partitions that disappeared, it's the data on them. So the files might still be on the disk I just don't know how to recover them without risking overwriting the empty space they left after themselves.
What I've tried (running on the partitions from a live Ubuntu from USB):
I tried Gparted's recover data option but it didn't find anything useful.
I tried recovering superblocks with e2fsck, they're all the same.
I had minor success trying PhotoRec, which recover files from / almost the original size of the /, but the files are just gibberish with random names and folder structure.
gpart, testdisk, scalpel and extundelete didn't help either (at least the way I've tried them with my limited knowledge).
Background:
I was backing up /home as well, but have omitted /home recently. I also omitted backing up flatpak folder because it was eating up a lot of space. I was also running Docker (some people suggest Docker+Timeshift can cause problems).
Anyone has any lead on how to bring my system back?
