Btrfs File Recovery: How to Rescue Data

Btrfs file recovery is possible using built-in tools like btrfs restore and btrfs check, which can recover files from damaged or unmountable filesystems. This article explains how to recover deleted or lost files from a Btrfs volume, what tools to use, and how to avoid common pitfalls.

Formula

The overwrite risk estimate is based on the probability that a deleted file’s data blocks have been reused. It uses the formula:

risk = (1 - e^(-0.1 * (used / size) * time)) * 100

• time – hours since deletion (h)
• used – used space on the filesystem (GB)
• size – total filesystem size (GB)
• risk – estimated percentage chance that the file’s data has been overwritten

This is a heuristic, not a guarantee. It assumes random block allocation and a constant write rate; real workloads vary.

Worked Example

Using the default values: 24 hours since deletion, 100 GB filesystem, 60 GB used.

1. Calculate the exponent: -0.1 * (60/100) * 24 = -1.44
2. Compute e^(-1.44) ≈ 0.2369
3. Risk = (1 – 0.2369) * 100 = 76.31%

The calculator shows about 76% estimated overwrite risk. That means the file’s data blocks are likely already reused, so recovery becomes much harder.

How Btrfs Stores Data and Why It Matters

Btrfs is a copy-on-write (CoW) filesystem. When you modify a file, it writes new data to a new block and then updates the metadata to point to it. This design helps with snapshots and checksums, but it affects recovery in two ways:

• Deleted files are not immediately wiped; the blocks are marked free but the data remains until overwritten.
• Snapshots can preserve old versions of files, even after deletion from the live subvolume.

Because of CoW, the original data blocks of a deleted file may remain intact for a long time if the filesystem isn’t heavily used. However, Btrfs does not have a trash-like “recycle binâ€� for files deleted with rm; they are gone from the directory structure immediately.

Recovery Methods: From Snapshots to Low-Level Tools

There are several approaches, ordered from easiest to most complex:

• Snapshots – If you have a snapshot taken before deletion, simply copy the file from the snapshot subvolume. This is the most reliable method.
• btrfs restore – A built-in tool that scans the filesystem for file data and extracts it to a target directory. It works on unmounted filesystems and can recover files even if the metadata is damaged.
• btrfs check –repair – Fixes filesystem inconsistencies, which may make the volume mountable again. Use with caution; it can cause further damage if used incorrectly.
• Third-party tools – Tools like photorec can carve files based on their content signatures, but they don’t understand Btrfs metadata, so filenames and directory structure are lost.

For a simple deleted file, btrfs restore is usually the best bet. For a corrupted volume, btrfs check may help, but it should be a last resort.

Step-by-Step: Using btrfs restore

To recover files from a Btrfs volume that is unmounted or failing:

1. Identify the device: lsblk or blkid to find the partition (e.g., /dev/sda2).
2. Create a destination directory: mkdir /mnt/recovery
3. Run btrfs restore /dev/sda2 /mnt/recovery. This scans the whole filesystem and copies all recoverable files.
4. If you know the file’s path, use -i <path> to limit the search: btrfs restore -i /home/user/documents /dev/sda2 /mnt/recovery
5. For a dry run, add -D to list files without copying.

This tool works on unmounted filesystems. If the volume is mounted, unmount it first. The recovery may take a long time on large disks.

When to Use btrfs check –repair

If the filesystem won’t mount due to metadata corruption, btrfs check can attempt repairs. However, it is a powerful tool that can cause data loss if misused. Always:

• Make a full image backup first: dd if=/dev/sda2 of=/path/to/image.img
• Run btrfs check /dev/sda2 without repair first to see the errors.
• Only then run btrfs check --repair /dev/sda2 as root.

After repair, try mounting the volume and copy important data immediately. Do not continue using the repaired filesystem as your primary storage until you’ve verified integrity.

Common Mistakes and Misconceptions

Many users expect a “trash� folder or a simple undelete command. Btrfs doesn’t have that. Others think that because the file is still visible in a snapshot, it’s safe to keep using the main subvolume. That’s true, but only if the snapshot is on the same physical disk; if the disk fails, both are lost.

Another misconception is that btrfs restore will preserve the directory structure. It does, but only for files it can find via metadata. If metadata is damaged, it falls back to raw block scanning, which loses filenames.

Finally, don’t install recovery tools on the same disk you’re trying to recover from. That writes new data and can overwrite the very blocks you need.

Prevention: Snapshots and RAID

The best recovery is not needing it. Btrfs snapshots are cheap and can be taken automatically with tools like snapper or btrbk. Schedule them regularly, especially before system updates.

For hardware failures, consider Btrfs RAID modes (RAID1, RAID10) which provide redundancy. However, RAID is not a backup – accidental deletions or corruption propagate across all copies. Snapshots protect against those, so use both.

Also, scrub your filesystem periodically with btrfs scrub to detect and repair silent corruption.

Frequently Asked Questions

Can I recover a deleted file from Btrfs without a snapshot?

Yes, btrfs restore can often recover files deleted from the live subvolume, as long as the data blocks haven’t been overwritten. The sooner you stop using the filesystem, the better the chances.

Does Btrfs have a recycle bin?

No, Btrfs does not have a built-in trash for files deleted via rm. However, some desktop environments move files to their own trash folder, which is just a normal directory. If you used a file manager, check ~/.local/share/Trash.

Is btrfs restore safe to run on a mounted filesystem?

No, you should unmount the filesystem first. Running it on a mounted volume can lead to inconsistent results and may cause further damage. If you can’t unmount, boot from a live USB.

What’s the difference between btrfs restore and photorec?

btrfs restore understands Btrfs metadata, so it can recover filenames and directory structure when metadata is intact. photorec ignores the filesystem and scans raw data for file signatures, so it works on any filesystem but loses names and structure.

Can I recover a file from a corrupted Btrfs volume?

Sometimes. If the corruption is in metadata, btrfs check --repair might fix it. If it’s in the data blocks, the file may be unrecoverable unless you have a RAID configuration or a snapshot.

How long does Btrfs keep deleted data?

Indefinitely, until the blocks are reused. On a busy filesystem, that could be minutes; on an idle one, months. The overwrite risk calculator above gives a rough estimate based on usage.

Related

• DirectX Cache Folder Empty? Causes & Fixes
• Google Home Max Loses Smoke Alarm & Burglar Detection?
• Best 20 Smart Home Purchase? Honest Verdict

in t | Time since deletion | hours | 24 | 0
in s | Filesystem size | GB | 100 | 0
in u | Used space | GB | 60 | 0
out risk | Estimated overwrite risk | % | (1 - exp(-0.1 * u / s * t)) * 100 | 0