I accidentally ran `sudo rm -r /home/` on a Debian dual-boot system. The root filesystem, including `/home`, is on `/dev/nvme0n1p7`, an ext4 partition on an NVMe SSD. I have not intentionally written anything else to the partition and am shutting down Debian before booting an Ubuntu live USB. What is the safest recovery procedure, and how can I avoid overwriting whatever data might still be recoverable?
3 Answers
Shut the system down immediately and do not boot Debian or mount the affected partition again. From the live USB, make a complete block-level image of `/dev/nvme0n1p7` onto another drive using a tool such as `ddrescue`, then perform recovery attempts on the image rather than the original partition. Since this is an NVMe SSD, TRIM or discard may already have erased the filesystem blocks, so recovery may be impossible, but creating an image first gives you the best chance. Do not save recovered files back to the same drive.
If the files matter, consider a professional recovery service before experimenting. Otherwise, after preserving an image, tools such as PhotoRec or other filesystem-recovery utilities can be tried against the image, but expect incomplete results and little directory structure. For the future, use a backup system such as Borg and consider safer deletion tools that move files to a trash directory instead of immediately unlinking them.
The important distinction is whether you need the files or only a working user account. If the data is gone, you can reinstall Debian or recreate `/home/your-username` with the correct ownership and permissions. Without a backup, there may be no reliable way to restore the files, especially if TRIM has run on the NVMe drive.
Because the partition is on an SSD, recovery software may find filenames or directory entries but still be unable to restore the file contents. Avoid repeatedly mounting it or trying multiple repair utilities directly against the original device.