Arch Linux

320

Member

From: Belgium

Registered: 2026-01-04

Posts: 1

Ran rsync --delete from live USB and wiped /home — recover ?

Hello everyone,

TLDR
Tried to revert back to a snapshot after failing to update the BIOS and ended up deleting my data.

Context
I never updated the BIOS of my laptop, during the year I owned it, simply because I didn’t know how to.
2 weeks ago, I took a snapshot with Timeshift and tried to update the BIOS, following frame.work’s guide, but I struggled. (Had trouble with a « WARNING: a UEFI ESP partition not detected or configured »). I did a mistake and deleted the boot folder with EFI and GRUB inside and rebooted.

The issue
Ofc, I couldn’t restart the laptop anymore, thought I could navigate in its data and folder throughout an external USB with arch in it.
There wasn’t enough free space on the USB to install Timeshift. At that point I was tired and had already spent many hours on it, and so instead of searching by myself, I asked ChatGPT which told I didn’t need Timeshift and gave me this command to execute :

rsync -aAXv –delete /mnt/root/

Because of lazyness and dumbness, I didn’t analyse that command and just pasted it in, and it began to delete all my files. By the time I realised that and hit Ctrl-C, all my /home folder was gone. Luckly, not the Timeshift snapshot, but I didn’t include the /home directory in Timeshift's settings when I took it.
I haven’t “touched” the laptop since then (I was busy), it’s still in the same state as it is in this photo:

https://imgur.com/a/ABi7RkD

95 % of the home folder is copysaved to an external drive, but there is a video and some basic scripts I wrote which I’d like not to loose.

My question
My question is, is there a way to “undo” directly what the command did, or should I use a “bigger” USB with archlinux in it, and search for a “recovery software”? If I’m not mistaken, the datas aren’t really “deleted” until they’re overwritten, right? Is there anything specific I should avoid ?

My plan atm would be to try to retrieve the lost data, and use the snapshot to get back to the previous state, while leaving the learning of how to update the bios for another day.

Thanks in advance for any advice or suggestions, I'm happy to provide more infos if needed.

frostschutz

Member

Registered: 2013-11-15

Posts: 1,639

Re: Ran rsync --delete from live USB and wiped /home — recover ?

you can try photorec and various filesystem tools, but in general there is no undelete, none that works reliably, in any case. you'd need a snapshot, backup, or the like to recover.

for scripts (plain text files) you can also try `strings -t d -n 20 -w /dev/partition | grep -C 1000 'something unique in your script'`, see if it finds something anywhere

if you have the space, ddrescue the whole thing to some other media, then work on that in read-only mode

the datas aren’t really “deleted” until they’re overwritten, right?

if you put a printed document in the paper shredder, it's also still there, just not easy to recover

also disable trim, discard, fstrim.timer, etc. or it might be really deleted after all