Almost nothing is ever really done on any filesystem when you press “delete”. The only thing is that those physical parts of the disk with the “deleted” file are marked as “not in use”. The data is there still unchanged, until you save something else and that spot on the disk is the first free spot available for saving that new file.
So, if you accidentally delete files, make sure that nothing gets saved on that disk anymore, not even by the OS. So, either unmount the disk, or cut the power to your computer, or whatever. Then learn how to mount hard drives as read-only and how to mark the “not in use” spots on your disk as “this spot contains this file”.
This is why proper deletion of files always includes filling the disk with random data. As long as nothing has been written on top of where the file was (and in reality: still is), it’s still there. Only access to it has been removed, but that access can be regained. Been there, done that.
Would this be possible to fix on btrfs, or would you have to create a snapshot first?
The “fix” would be to not allow themes to execute code in the first place.
I mean once files are deleted maliciously or accidentally
you would need to have created a snapshot beforehand.
Then you could restore to the last snapshot. But you would need a live system to do that, if your installation is broken
Almost nothing is ever really done on any filesystem when you press “delete”. The only thing is that those physical parts of the disk with the “deleted” file are marked as “not in use”. The data is there still unchanged, until you save something else and that spot on the disk is the first free spot available for saving that new file.
So, if you accidentally delete files, make sure that nothing gets saved on that disk anymore, not even by the OS. So, either unmount the disk, or cut the power to your computer, or whatever. Then learn how to mount hard drives as read-only and how to mark the “not in use” spots on your disk as “this spot contains this file”.
This is why proper deletion of files always includes filling the disk with random data. As long as nothing has been written on top of where the file was (and in reality: still is), it’s still there. Only access to it has been removed, but that access can be regained. Been there, done that.