Can I safely delete /run/timeshift/backup in Ubuntu 20.04?

[Wrichik Basu]

I learned about timeshift in the Linux Mint blog, and then read from It's FOSS that the utility not only backs up data, but can restore the OS with all its settings and customizations. I installed timeshift following the instructions from the latter website. Upon starting it, it asked me for the password, which I gave. Then it started showing some customizations. I choose rsync, but then I decided that I will do it later, so I exited the software at that point of time.

Now, I found that there is a new directory: /run/timeshift/backup that is almost a copy of the root directory, including my home directory:

It's size, returned by sudo du -sh, is 320 GB. Too much.

I reopened timeshift and opened its logs. In the first log file, I found this:

[22:24:51] Snapshot device: '/dev/sda2'
[22:24:51] Snapshot location: /run/timeshift/backup

Note that I have not created any snapshot yet.

Given the above data, is it okay if I delete this folder using sudo rm -rf /run/timeshift/backup?

Edit:
I believe this folder is not just a "simple" folder. I have removed timeshift for the time being using sudo apt remove --purge --autoremove timeshift. I created a sample text file in my home directory, and that file "magically" appeared in /run/timeshift/backup. When I deleted the file from the latter directory, it got deleted from my home directory too! Therefore, deleting this directory is not safe. Also, a few days back, I remember seeing in the System monitor that my hard disk had around 590 GB space left. Currently, it is 589 GB. It means that /run/timeshift/backup is actually not taking up any space. It is somewhat like a shortcut that we have in Windows.

 

[jack action]

Shortcuts in linux are made with either hard links or soft links. Learn more about them here.

 

[Vanadium 50]

It's size, returned by sudo du -sh, is 320 GB.

If it's a link, erasing it will not recover any space.

 

[Wrichik Basu]

Shortcuts in linux are made with either hard links or soft links. Learn more about them here.

Thanks for the article.

If it's a link, erasing it will not recover any space.

Yes, that's true. In fact, now it seems to me that this folder is actually some kind of hard link, because the inodes for the files in a directory (as well as that for the directories) are the same. The best people to ask this question are perhaps the developers, so I posted a question in their GitHub repository.

 

[Vanadium 50]

The best people to ask this question are perhaps the developers, so I posted a question in their GitHub repository.

Um, no, you reported a bug (an "issue" in GitHub parlance) in their GitHub repository. You did this despite the documentation saying "Please do not expect a response as the tracker is checked once a year when the app is being updated". It also says " If you use Linux Mint and need support for an issue please use the Linux Mint support forums "

The documentation also says " Remember to delete all snapshots before un-installing. Otherwise the snapshots continue to occupy space on your system. To delete all snapshots, run the application, select all snapshots from the list (CTRL+A) and click the Delete button on the toolbar. This will delete all snapshots and remove the /timeshift folder in the root directory."

So, you didn't follow the directions (probably didn't even read the directions), got into trouble, and decided not to ask for help where the developer suggested and instead decided you needed some one-on-one help, which you tried to get by abusing the bug-tracker system.

In the past you have complained there isn't more open source software. This behavior is part of the reason why.

 

[Wrichik Basu]

Um, no, you reported a bug (an "issue" in GitHub parlance) in their GitHub repository. You did this despite the documentation saying "Please do not expect a response as the tracker is checked once a year when the app is being updated". It also says " If you use Linux Mint and need support for an issue please use the Linux Mint support forums "

In GitHub, it is common to post questions as issues. The repo even has a label for questions that has 18 open issues. GitHub has recently opened up Discussions, but not all repos have enabled it. In my issue title, I clearly stated that it was a question. If the developers feel necessary, they will close it/delete it.

Secondly, I am not using Linux Mint, so I cannot post in their support forum even if it is about their software.

The documentation also says " Remember to delete all snapshots before un-installing. Otherwise the snapshots continue to occupy space on your system. To delete all snapshots, run the application, select all snapshots from the list (CTRL+A) and click the Delete button on the toolbar. This will delete all snapshots and remove the /timeshift folder in the root directory."

So, you didn't follow the directions (probably didn't even read the directions), got into trouble, and decided not to ask for help where the developer suggested and instead decided you needed some one-on-one help, which you tried to get by abusing the bug-tracker system.

It's clearly stated in the OP that I did not create any snapshot:

Note that I have not created any snapshot yet.

Therefore, there exists no question of deleting the /timeshift folder. In addition, my question was not regarding the /timeshift folder, but about the /run/timeshift/backup folder.

 

[Vanadium 50]

You didn't follow the directions. And now you have problems. Why is this the developers' problem?

You also might want to think about what kind of answers you might get to the question "Hi, I didn't follow the installation instructions exactly, or the uninstalltion instructions at all, and now I have leftover files that I don't understand. Can I delete them?" Who can possibly answer this definitely? Further, who would dare give you advice? If it doesn't work, now it's their fault. I have two things I might suggest, but I'm keeping my mouth shut - they might make things worse.

You know when you type "sudo", you get the "With great power comes great responsibility" quote? That's intended to slow you down and make you ask questions like "are there instructions for this?"

 

[Wrichik Basu]

You didn't follow the directions. And now you have problems. Why is this the developers' problem?

You also might want to think about what kind of answers you might get to the question "Hi, I didn't follow the installation instructions exactly, or the uninstalltion instructions at all, and now I have leftover files that I don't understand. Can I delete them?" Who can possibly answer this definitely?

I don't get it. What instructions did I not follow? I installed the software using the proper instructions; I did not create any snapshots, so there was nothing to delete, and I followed the uninstallation instructions too. Moreover, now it is clear that the folder is some type of hard link/symbolic link, so I am not concerned that it is taking up space. I am just asking the developers a question: "What is this folder that was created by your software?"

Further, who would dare give you advice? If it doesn't work, now it's their fault. I have two things I might suggest, but I'm keeping my mouth shut - they might make things worse.

Things have already become worse. I asked a simple question. All of a sudden you accused me of misusing the GitHub issue system, and then started blaming me for something I didn't even do. You said I created snapshots that I didn't delete. In reality, I didn't even create snapshots, and I have said this over and over. I really do not like the way you are speaking here.

 

[berkeman]

Thread closed temporarily for Moderation...

 

[berkeman]

After a PM conversation involving a computing/technology Mentor, this thread is now re-opened. Let's please stay on the topic of the unexpected beviors, and whether others have seen this. Thank you.

Here is a quote from the computing/technology Mentor in the PM conversation:

The developers should have at least written in their repo that such a folder will get created even if the user does not create a snapshot. Anyone would become curious if they suddenly find a copy of the entire root directory inside another folder, and the very next question that arises is who made this copy, and then why it was needed. Moreover, there is some kind of script working under the hood such that even if the program is uninstalled, the script doesn't stop, and changes that are made anywhere on the PC are reflected in that folder.

 

[Vanadium 50]

First, you do not know that the program did not take a snapshot when installed. You guessed. Maybe it was a sensible guess. But you guessed. Then you did not follow the uninstall instructions, because you thought you didn't need to. That is where we are and how we got here, and if you want to get out of this mess, you need a clear idea of how you got into it in the first place.

How to get out of this mess? I see four options. In no particular order, they are:

Option A: Go through that folder, file by file. Delete what you don't need. You can likely restrict yourself to files that are not linked elsewhere (ls -l will tell you that). This will be slow, and you don't want to guess wrong about any file.

Option B: Reinstall Timeshift and immediately uninstall it, this time following the instructions. This might work, this might not, this might make a bigger mess.

Option C: Rename the folder in question to erase.me or something, reboot and hope for the best. If nothing seems to be amiss, then you can delete it. If the system doesn't boot, reboot with a rescue disk and change the name back.

Option D: Restore from your last good backup.

 

[pbuk]

EDIT: the suggestion in the first paragraph here was incorrect - never delete anything in /run unless you really know what you are doing.

Option E: You won't affect the original files by doing rm -rf /run/timeshift/backup. Although the files have the same inodes (because that's what a hard link is), those inodes will not be deleted whilst they are still referred to by the original directory entry.

If you don't have a reliable backup or clean underwear on hand I recommend instead a variant on Option B: install Timeshift and let it do its thing for a while. Uninstall it (properly) if you get fed up with it (which if you do a lot of file adding and removal e.g. through switching git branches or installing node modules you will do pretty quickly).

If you ctrl-c'd out of the Timeshift installation you may have to run dpkg --configure -a before you can do anything else.

 

[Vanadium 50]

While I agree that if this were a sanely designed piece of software, Options D and E are equivalent, with E being faster. That may not be the case, and I'd spend the minute making sure.

 

[Wrichik Basu]

First, you do not know that the program did not take a snapshot when installed. You guessed. Maybe it was a sensible guess. But you guessed.

Yes, I definitely know that the program did not take a snapshot. If it did, it would show up in the software, and there would be /timeshift folder directly under the root directory. These were not present.

Then you did not follow the uninstall instructions, because you thought you didn't need to.

I followed the uninstallation instructions. Please see my previous posts; I have said it many times over.

That is where we are and how we got here, and if you want to get out of this mess, you need a clear idea of how you got into it in the first place.

Nope, this is not how we got here. Let me reiterate what I did.

1. I installed the program.
2. Clicked on the software icon from the launcher.
3. It asked me for my password, which I gave. (Other websites indicate this is safe.)
4. The software started, and asked me to choose between RSYNC and BTRFS. I chose the former.
5. The software initialized itself, and opened up the main window where snapshots would be listed. It was empty.
6. I discovered the /run/timeshift/backup folder. Nautilus said it took 390 GB of space (but later I found that the free space on my hard disk was the same before I installed the software).
7. I found that any changes that I make anywhere are reflected in that folder.
8. I decided to uninstall the software. Since I did not take any snapshot, there was nothing to delete. I simply used apt to remove it and purge it.
9. The /run/timeshift/backup folder was still there, and point 7 was still valid.

The current situation is this:

1. I don't have timeshift installed.
2. I still have the /run/timeshift/backup folder intact.
3. Deleting any file/folder from the above folder will delete it throughout the hard disk.
4. The folder is not taking up any space, so that is a big relief.

Option B: Reinstall Timeshift and immediately uninstall it, this time following the instructions.

Already tried this. Doesn't work.

Option A: Go through that folder, file by file. Delete what you don't need. You can likely restrict yourself to files that are not linked elsewhere (ls -l will tell you that). This will be slow, and you don't want to guess wrong about any file.

If I do this, I will delete off the files from both locations.

Note that in the GitHub issue I have linked above, another person has said that they have the same question. So, I am not alone.

The best I can do in the current situation is to wait for an explanation from the developer. Since the folder doesn't take up any space, maybe I can ignore its presence. In my daily usage of my laptop, I seldom visit the root directory, and almost never visit /run. So, it shouldn't bother me much.

 

[pbuk]

EDIT: updated to reflect the use of /run/timeshift by Timeshift when it is installed on the same physical drive as is being backed up.

7. I found that any changes that I make anywhere are reflected in that folder.

Really? What happens if you create a new file in your home folder? If [a hard link to] this is created in /run/timeshift... then either the Timeshift daemon is still running and it has not been uninstalled properly, or /run/timeshift/backup is a duplicate partial mount of the filesystem and deleting it would be bad.

The current situation is this:
3. Deleting any file/folder from the above folder will delete it throughout the hard disk.
...
If I do this, I will delete off the files from both locations.

This is not correct, and to verify this do the following:

1. Take a copy of a file in your home folder that is linked in both locations (put it on a USB stick for safety).
2. Check the inode of the original copy of the file and the inode in /run/timeshift... are the same with ls -i -l
3. Remove the hardlink from the /run/timeshift... directory with rm myfile.txt
4. Check the original copy of the file is still there (it won't be).

EDIT: The following paragraph is true, but not relevant because Timeshift does not use hard links, it mounts (part of) the filesystem under /run/timeshift/backup.

Once you have done this it is probably a good idea to read some background on how ext4, and posix implementations generally, work. The key point here is that directory entries are not files, they are pointers: inodes are files. Removing a pointer to an inode does not delete the inode, although if it was the only pointer the inode will delete itself. (Note that symlinks are pointers to pointers and the inode knows nothing about them).

 

[Vanadium 50]

Deleting any file/folder from the above folder will delete it throughout the hard disk.

Really? Have you tried this?

I followed the uninstallation instructions. Please see my previous posts; I have said it many times over.

Yes, you do keep saying this. But what you say you did and what the instructions say to do are different.

 

[Wrichik Basu]

Really? What happens if you create a new file in your home folder?

Really? Have you tried this?

Yes, I have tried this, otherwise I could not make this claim. Any new file that I create in my home folder gets linked to that folder. If I delete it from the home folder, it gets deleted from that folder too. If I delete it from that folder, it vanishes from the home folder as well. It's weird, I know, but that's exactly what I found. Also tried restarting the PC several times, but the folder still exists.

 

[pbuk]

Yes you are right - these files are not hard links they are a duplicate mount of the filesystem. Deleting them would be bad, however they take up no space and can be safely ignored.

How do I know this? I created a virtual machine and went through the steps... it is now a virtual brick.

Moral of the story: don't play with things that do low-level stuff like backup on your live machine. If you really can't live with the additional mount the best thing may be to reinstall linux (which shouldn't be a big deal anyway - I hop between Linux installs about once a month).

 

[Vanadium 50]

Yes, I have tried this, otherwise I could not make this claim.

Then it's not a link. That verifies what @pbuk sees.

If you do a cat /etc/mtab | grep timeshift what do you see?
If nothing, try cat /proc/mounts | grep timeshift.

 

[Wrichik Basu]

If you really can't live with the additional mount the best thing may be to reinstall linux

No need for that. As the mount doesn't take up space, it doesn't bother me. I can live with it.

 

[Wrichik Basu]

If you do a cat /etc/mtab | grep timeshift what do you see?

The following is returned on the terminal:

/dev/sda2 /run/timeshift/backup ext4 rw,relatime,errors=remount-ro 0 0

 

[Vanadium 50]

OK, see if it's in /etc/fstab. If it is, removing the line from fstab and rebooting should solve this.

 

[Wrichik Basu]

OK, see if it's in /etc/fstab. If it is, removing the line from fstab and rebooting should solve this.

Probably I will leave it as it is. Don't want to mess with my system. Now that I know that it is a mount rather than a link, my curiosity has been satisfied too.

Thanks everyone for the help.

 

[pbuk]

OK, see if it's in /etc/fstab. If it is, removing the line from fstab and rebooting should solve this.

It won't be - I just checked on a fresh VM. However I was able to permanently remove /run/timeshift with the following steps:

# Reinstall timeshift so you can delete any snapshots.
sudo apt install timeshift
# [Use the Timeshift gui to delete any snapshots]
# ...
# Now uninstall it again.
sudo apt uninstall timeshift -y
sudo apt purge timeshift -y
sudo apt autoremove
# Reboot

Also I note the OP installed Timeshift from its own PPA, presumably without understanding the consequences. This will also need removing and the easiest way on Ubuntu is the Software Sources gui.

 

[Vanadium 50]

However I was able to permanently remove /run/timeshift with the following steps:

However, the OP has refused to perform Step 3, depsite the instructions saying to do exactly that. He kn ows for sure that no snapshots were installed (despite the fact that we've been looking at one for the duration of the thread.) We need to find some other way if we want to remove it.

After seeing what Timeshift appears to be doing and how it appears to be doing that, I am skeptical that it would be successful in rolling back a broken system to the last working version. It might do an OK job in rolling back from one working system to a previous working system.

Also I note the OP installed Timeshift from its own PPA, presumably without understanding the consequences. This will also need removing

No argument here. I think there is a general lack of consequence non-understanding. Sudo asks you if you know what you're doing, but for root access the answer needs to be "yes, I really, really know what I am doing" and not "oh, it will probably be OK". Sudo/su is really working without a net.