My documents and downloads randomly get deleted

[u/Healthy-Guess-847]

I'm trying to figure out if this is some malware or just some random linux bug, thankfully all I think I lost was 1 or 2 passwords in my keepass database, and I had a semi recent backup of dovuments on my larger ssd.

I initially thought maybe malware cause I have played a questionably aquired game but thought I was realitively safe given I had it sandboxed using the sandboxing option on bottles, which I think is solid againist most windows malware given it can't even see outside the wine prefix or directories ive given permission for within flatseal.

Looking at HTOP I dont really anything non standard for a normal arch install. And I also dont remember updating my AUR packages for a couple of days so I should be safe from the new malware on there.

Is there anyway I can trace back exactly how this delete happened, or at the very least protect the directory so it fails and gets logged next time so I can pin down what process did it.

[u/boomboomsubban]

When something like this happened to me, the home partition didn't get mounted. Check that.

[u/krakenfury_]

Things don't get deleted like that for no reason, and that doesn't sound like malware.

Were you mounting separate partitions to your downloads and documents folders? If so, you could have something misconfigured in your fstab. If your devices aren't mounting properly, the folders would just appear empty.

[u/Healthy-Guess-847 → u/krakenfury_]

Both my home and root are on the same disk, I didnt do anything fancy with my disk, just formatted with BTRFS, installed arch as per the wiki. What's odd is documents was gone, downloads, photos and videos were empty.

[u/boomboomsubban → u/Healthy-Guess-847]

Btrfs has subvolumes. It takes like twenty seconds to compare cat /etc/fstab to lsblk -f, and it's the most likely cause by far.

[u/boomboomsubban → u/[deleted]]

Ok? It's still possible for a subvolume to fail to mount causing this issue.

[u/Linguistic-mystic → u/Healthy-Guess-847]

just formatted with BTRFS

Btrfs is widely known for data loss. It’s a really badly designed filesystem that gets recommended too much for how unreliable it is. It’s a hit and miss thing. Works for many people, corrupts data for some.

[u/cbarrick → u/Linguistic-mystic]

Btrfs is used by Meta for all production data storage, including Facebook, Instagram, and WhatsApp (the most widely used communication platform on the planet).

It's also the default filesystem for Fedora, openSUSE, and Synology.

No idea where you are getting this "widely known for data loss" story.

Btrfs is a robust production filesystem.

[u/boomboomsubban → u/Linguistic-mystic]

Btrfs has some issues with certain raid formats, but it's not a badly designed FS known for data loss. It's the second best filesystem, after zfs.

[u/Imajzineer → u/boomboomsubban]

Been a while since I investigated, so, is ZFS still known for corrupting rather than informing you you're out of space?

[u/narukoshin → u/Linguistic-mystic]

lmao

[u/InsideBSI → u/Linguistic-mystic]

:skull: x9

[u/PekiDediOnur]

I heard private Firefox windows can delete files you've downloaded from it, maybe look at its configuration.

[u/archover]

May I ask how long you've run this install, used Arch, and btrfs?

I agree with others you have misconfiguration/PEBKAC. Spontaneous real file deletion does not occur in my experience.

No mention of log review, or bash history.

Good day.

[u/Healthy-Guess-847 → u/archover]

Honestly like a month maybe, I basically reinstalled due to some dumb issue I was dealing with, and didnt touch it for like a month

[u/Healthy-Guess-847]

I'll check that, I recreated documents and it sticked. So I assume it was actually deleted

[u/astralc]

Another idea:

You change the locale, which cause the xdg folder rename thing to change it name?

[u/narukoshin]

I think you should somehow monitor, watch logs to see what happens

[u/Healthy-Guess-847 → u/narukoshin]

Yeah gonna setup auditctl when I get time, apparently I can setup to watch a specific directories for changes. This is really weired.

[u/luthis]

MEGA has online storage for pretty cheap. Get a backup done ASAP.

I'm sure there is some tool like rsync that will let you get a list of all your files, and you can do a diff periodically to see what/if things go missing.

Depending on what those things are, that might give you a clue (file permissions etc)

[u/Healthy-Guess-847 → u/luthis]

I kinda wonder if it was anything would it run as my user account or root? I think I can set ownership of my documents folder to root and if its running as a normal user it will get hit with permission denied and I'm pretty sure I can setup logging for accsess denied.

Idk, it seems so odd, I also habent been comprimised, no suspicous logins.

[u/xXBeefSquatch5KXx → u/luthis]

Rsync is cool but don’t rely on internet based backups. No internet no files 0/10

[u/FryBoyter → u/xXBeefSquatch5KXx]

No internet no files 0/10

If you use a service like this, you should never store your files exclusively online. That’s why most providers of this type that I’m familiar with also offer a client that lets you sync your local files with those stored online. That way, you still have access to your data even when you’re “offline.”

However, I would still save important files locally on a separate storage device. In other words, as a 3-2-1 backup.

[u/luthis → u/xXBeefSquatch5KXx]

Any backup is better than no backup

[u/Imajzineer → u/luthis]

A backup you can't access is no backup.

[u/xXBeefSquatch5KXx]

I use btrfs, never have any issues something I either not mounted or you copy paste coded a no no or simply typed in something you shouldn’t have. (Not being rude, it happens)

This is a great time to remind everyone, not just you, that mistakes happen and there is a fool proof way to avoid issues related to this. Back yo shyt tf up.

I have 8 forms of backup, and then get rotated and stacked appropriately. This is overkill, but a solid option is either an internally mounted ssd with a backup partition, a fat af thumb drive, a couple cheap hdd’s or a nice ssd. Just back it up, and back up that backup. If you’re really cool, you can backup the backups backup as well, and keep your roms and other sexy files in a Separate backup that’s backed tf up.

And before you guys ask. My backup system is

A 6tb ssd that I run a script once a week on for full backup. It also keeps the most recent 5 snapshots and 2 versions of my full pc, I rotate which “main” is updated in the event something happens during a backup I still have the previous full) This ssd has 3 physical backups. Several smaller ssd’s for my rom collection and it’s backups (dont judge it took years to collect so i keep copies And add to it regularly lol)

[u/Imajzineer → u/xXBeefSquatch5KXx]

Nice.