Disclaimers: 1) I am trying to learn and use Syncthing without fully understanding its functionality and terminology because reasons. 2) The color red does not mean the same for everyone. Please humor me.
I installed Syncthing so I could work on an Obsidian vault in sync with a group. I don’t consider myself tech-illiterate, but setting up networks is definitely not my specialty.
While setting up the folder path to sync, my mind thought it would be best to choose an existing folder path in my computer, one related to all my documents, work, files, etc.
Seeing the files in said folder being recognised but not understanding yet why things weren’t syncing between computers, I ultimately chose to press the red “revert changes” button, not fully understanding the function or implications of the warning. I saw the folder size swiftly reduce, and very swiftly my files were gone. So incredibly fast.
I’m pulling data recovery software to see where they went and they seem to be nowhere in my computer. I genuinely haven’t experienced such a fast data wipe.
So my real question is, so I can understand a bit more about Syncthing:
When this happens, what happens with all the files? Do they get “uploaded” to a Syncthing cloud? Can they be recovered at all? Do they get lost in a limbo? Do they just get wiped?
That button shows up when you set a folder as “Receive Only” and then change it locally, as changes in “Receive Only” folders aren’t supposed to be synced with the rest of the cluster.
The “Revert Local Changes” button undoes everything you changed in your folder.
If you created files, it deletes them.
If you modified existing files, it undoes those changes.
The files existed in a path on my desktop computer way before I installed Syncthing. I added a folder on Syncthing and chose that path (the one that usually is left blank for Syncthing to create C:\Users\user\Sync, but I decided to specify an existing one because I thought it would be convenient).
In any case, what I want to understand is, how are those files deleted? Are they reallocated on my disk, are they broken down into blocks, do they go into a different filesystem?
They are deleted however the filesystem treats permanent deletions, which is usually the first one.
From my understanding, Syncthing’s versioning only stores old remote versions, but I think it’s worth checking them anyway. In the Web GUI, you can see your versions by clicking the “Versions” button (which is next to the “Pause” button) in your expanded folder.
If there is no “Versions” button or .stversions subdirectory, you have versioning disabled, and will have to recover your data in another way (like with a recovery tool).
Are you using a very old version of Syncthing by any chance (e.g. one that comes from your Linux distribution’s repository)? I’m asking, because normally, there is yet another pop-up displayed when you press that button, with a more detailed explanation of what is going to happen if you continue.
So my files should still be able to be dug out with a data recovery tool within my computer. It’s not like Syncthing is unintentionally the fastest data-wiping interface there is. This is all I’m asking. Am I getting this right?
Strictly speaking from a data recovery standpoint, the best first step is to immediately take the storage media/drive offline. The longer it’s in active use, the lower the chances of successfully recovering deleted files.
Is the storage media magnetic (e.g. HDD) or flash (e.g. SSD)?
I would add that if the data is critical, this literally means pulling the power cord out of the computer. Then, you move the drive to another device and try to recover the deleted data there, with special caution that nothing is written onto it in the process.
And depending on the value of the data, it may be well worth the effort and expense to clone the drive and do recovery from the disk image instead of the original drive (many data recovery tools support working from a disk image).
It lowers the chances of the drive dying before recovery is complete (file carving is an I/O intensive process), and adds an additional layer of safety.
