Recovering Linux Mint Systems Using Timeshift Snapshots

The Problem: System Instability After Changes

Installing a new kernel, updating drivers, or modifying critical system configuration files can occasionally lead to a "broken" state where the OS fails to boot or behaves unpredictably. The goal is to establish a reliable point-in-time snapshot of the root filesystem that allows you to revert the system to a known working state without reinstalling the entire operating system.

Prerequisites

• Linux Mint Installation: Any current edition (Cinnamon, MATE, or Xfce).
• Timeshift: Pre-installed by default. If missing, install via terminal:

  sudo apt update && sudo apt install timeshift

• Administrative Access: Sudo privileges are required for all snapshot and restore operations.
• Storage: A separate partition or external drive formatted as ext4 or btrfs. Caution: When using RSYNC mode, do not store snapshots on the same partition being backed up to avoid recursive loops and disk exhaustion.

Configuring and Creating Snapshots

1. Launch Timeshift from the application menu (Administration → Timeshift) or run

   sudo timeshift-gtk

   in the terminal.
2. Select Snapshot Type:
   • RSYNC: Uses hard links to create a copy of the system. Works on any filesystem (ext4, xfs, etc.).
   • BTRFS: Uses atomic snapshots. Requires the system to be installed on a BTRFS filesystem. This method is nearly instantaneous and more space-efficient.
3. Choose Target Location: Select the drive or partition dedicated to snapshots.
4. Set Schedule: Define how many hourly, daily, or weekly snapshots to retain. This prevents the disk from filling up by automatically pruning the oldest entries.
5. Execute: Click Create to manually trigger an immediate snapshot.

Verifying Snapshot Integrity

Once the process completes, verify that the snapshot is registered and accessible. In the Timeshift GUI, the entry should show the current date/time and a status of OK.

To verify via the command line, run the following as root:

sudo timeshift --list

The output should include a snapshot label and a path similar to /timeshift/snapshots/2023-10-27_10-00-00. If the GRUB integration is enabled in settings, you can reboot the machine and select the snapshot from the boot menu to verify the system state in a read-only environment.

Restoring the System

Scenario A: System is Bootable

1. Open Timeshift and select the desired snapshot from the list.
2. Click Restore.
3. Confirm the target device (usually your internal system drive). Risk: This will overwrite current system files. Ensure any critical personal data created since the snapshot is backed up separately, as Timeshift focuses on system files, not home directories by default.
4. Allow the process to finish and reboot.

Scenario B: System Fails to Boot

1. Boot from a Linux Mint Live USB.
2. Install or launch Timeshift within the live environment.
3. Point Timeshift to the snapshot storage drive.
4. Select the snapshot and restore it to the internal system partition.
5. Reboot into the restored internal drive.

Limitations and Practical Checks

Limitation	Practical Check/Mitigation
Disk Space	Run df -h on the snapshot partition to ensure it isn't reaching 100% capacity.
LUKS Encryption	Ensure the snapshot target is accessible or the passphrase is available during Live USB restoration.
Data Loss	Verify that /home is excluded from snapshots if you prefer manual data backups over system-state reverts.

To confirm a successful restore, check the modification timestamp of a file you know was changed after the snapshot was taken:

stat /etc/hostname

The Modify timestamp should now match the date of the restored snapshot rather than the date of the failed change.

Rollback Procedure

Because a restore operation overwrites the current root filesystem, the only way to "undo" a restore is to perform another restore using a different, earlier snapshot. Always create a manual snapshot immediately before performing a major system upgrade to provide a guaranteed recovery point.