I'm using Lubuntu 24.04 LTS and meant to remove only a subfolder inside /etc, but I accidentally ran `sudo rm -r /etc`. I had previously created a Timeshift snapshot, but Timeshift no longer launches from the application menu. Is there a practical way to restore the system—possibly from a live USB or the Timeshift snapshot—or is reinstalling the operating system the safest option?
4 Answers
You can try working from a terminal or live environment and check whether Timeshift can still see the snapshots with commands such as `sudo timeshift --list`, followed by `sudo timeshift --restore`. If the snapshot is accessible, restoring the whole system state is generally safer than trying to recreate /etc manually.
For the future, be extremely cautious with recursive commands run through sudo. Consider using `rm --interactive` so deletions require confirmation, or move files somewhere temporary instead of deleting them immediately. Testing a command with a harmless path and carefully checking the complete command before pressing Enter can prevent this kind of disaster.
Copying /etc from installation media or reinstalling packages might make the system bootable, but it will not reliably recreate all of the configuration that was deleted. Manually rebuilding /etc is complicated and easy to get wrong. If the snapshot cannot be restored, a clean reinstall is usually the most dependable solution; back up your home directory first if it is still accessible.
Your best recovery option is the Timeshift snapshot. Since the installed system is damaged, boot from a live USB, locate the snapshot storage, install or run Timeshift in the live environment, and restore the most recent snapshot. A live session is useful because it does not depend on the deleted files in your installed system. There is no guarantee the restore will work, so protect any important personal files first.
I still have the USB I used to install Lubuntu, but I’m not sure what it means for a live system to have Timeshift installed by default.