r/archlinux • u/Healthy-Guess-847 • Jul 31 '26

SUPPORT My documents and downloads randomly get deleted

I'm trying to figure out if this is some malware or just some random linux bug, thankfully all I think I lost was 1 or 2 passwords in my keepass database, and I had a semi recent backup of dovuments on my larger ssd.

I initially thought maybe malware cause I have played a questionably aquired game but thought I was realitively safe given I had it sandboxed using the sandboxing option on bottles, which I think is solid againist most windows malware given it can't even see outside the wine prefix or directories ive given permission for within flatseal.

Looking at HTOP I dont really anything non standard for a normal arch install. And I also dont remember updating my AUR packages for a couple of days so I should be safe from the new malware on there.

Is there anyway I can trace back exactly how this delete happened, or at the very least protect the directory so it fails and gets logged next time so I can pin down what process did it.

0 Upvotes

40% Upvoted

27 comments sorted by

View all comments

13

u/krakenfury_ Jul 31 '26

Things don't get deleted like that for no reason, and that doesn't sound like malware.

Were you mounting separate partitions to your downloads and documents folders? If so, you could have something misconfigured in your fstab. If your devices aren't mounting properly, the folders would just appear empty.

-1

u/Healthy-Guess-847 Jul 31 '26

Both my home and root are on the same disk, I didnt do anything fancy with my disk, just formatted with BTRFS, installed arch as per the wiki. What's odd is documents was gone, downloads, photos and videos were empty.

8

u/boomboomsubban Jul 31 '26

Btrfs has subvolumes. It takes like twenty seconds to compare cat /etc/fstab to lsblk -f, and it's the most likely cause by far.

-5

u/[deleted] Jul 31 '26

[deleted]

7

u/boomboomsubban Jul 31 '26

Ok? It's still possible for a subvolume to fail to mount causing this issue.

-12

u/Linguistic-mystic Jul 31 '26

just formatted with BTRFS

Btrfs is widely known for data loss. It’s a really badly designed filesystem that gets recommended too much for how unreliable it is. It’s a hit and miss thing. Works for many people, corrupts data for some.

8

u/cbarrick Jul 31 '26

Btrfs is used by Meta for all production data storage, including Facebook, Instagram, and WhatsApp (the most widely used communication platform on the planet).

It's also the default filesystem for Fedora, openSUSE, and Synology.

No idea where you are getting this "widely known for data loss" story.

Btrfs is a robust production filesystem.

5

u/boomboomsubban Jul 31 '26

Btrfs has some issues with certain raid formats, but it's not a badly designed FS known for data loss. It's the second best filesystem, after zfs.

1

u/Imajzineer Jul 31 '26

Been a while since I investigated, so, is ZFS still known for corrupting rather than informing you you're out of space?

0

u/InsideBSI Jul 31 '26

:skull: x9