Every Linux user eventually meets the update that bites back: a new kernel that panics on boot, a graphics driver that leaves you at a black screen, or a config edit that seemed harmless until the next reboot. The usual recovery path is a long evening of live USBs, chroot sessions, and guesswork. Timeshift exists to make that evening ten minutes long instead. It takes snapshots of your system files, and when something breaks, it puts them back exactly as they were.

What Timeshift is, and what it is not

Timeshift is a system restore tool, not a backup tool for your personal files. By default it snapshots system files and excludes your home directory, so restoring a system snapshot never wipes documents you created after it was taken.

That distinction decides your whole strategy. Timeshift protects you from bad updates and bad config edits. It does not protect your photos and documents from a dead drive. For those, you need a real file backup alongside it, such as a Restic backup routine that copies your home directory somewhere else. And if your filesystem is Btrfs with the right subvolume layout, the Snapper playbook offers snapshots with bootable rollback entries, which Timeshift on its own does not provide.

Two more honest limits up front. A snapshot stored on the same disk does not survive that disk dying; a second drive or partition is strictly better when you have one. And Timeshift's RSYNC mode, the one most people should use, restores from a live USB if the system cannot boot. That is fine, as long as you know it before disaster day, not on it.

Before you start

You need a Linux desktop or server, sudo access, and at least 10 to 20 GB of free space for a comfortable set of snapshots. A separate partition or drive is the ideal snapshot location; the root partition works, but it shares space with the system it protects.

Timeshift offers two snapshot types. RSYNC mode copies changed files and works on any filesystem, which makes it the safe default. BTRFS mode is faster, but it only works if your root filesystem is Btrfs with an Ubuntu-style @ subvolume layout; check with findmnt / and choose RSYNC unless that layout is confirmed.

Step 1: Install Timeshift

Timeshift is in the default repositories of most major distributions. Use your distro's native package, not a containerized one, since it needs full access to system files. New to installing software? See the general guide to installing software on Linux.

On Ubuntu, Debian, or Linux Mint:

BASH
sudo apt update && sudo apt install timeshift

On Fedora:

BASH
sudo dnf install timeshift

On Arch Linux:

BASH
sudo pacman -S timeshift

Confirm it is there with timeshift --version. If your distro does not package it, the project's GitHub releases page ships installers, but a distro package is preferable because it gets updates with everything else.

Step 2: Run the setup wizard once

Launch Timeshift from your application menu, or run sudo timeshift-gtk for the graphical interface. The first run opens a setup wizard with four decisions that matter:

  1. Snapshot type. Choose RSYNC unless you confirmed the Btrfs layout above.
  2. Snapshot location. Pick the drive or partition with the most free space. An external drive that stays plugged in works; one that lives in a drawer does not, because scheduled snapshots will silently fail while it is away.
  3. Schedule. Monthly plus weekly is a sane baseline for a desktop; add daily if you tinker constantly. Set how many of each level to keep, or old snapshots will quietly eat your disk.
  4. Users. Leave the default exclusion of home directories in place. Including all of /home turns a system restore into a data-destroying event, which is the opposite of what you want.

Finish the wizard, and scheduled snapshots take over from here.

Step 3: Take your first snapshot right now

Do not wait for the schedule. Take a manual snapshot while the system is healthy, so your first restore point is a known-good state rather than a snapshot taken after something already went wrong. Click Create in the interface, or from the terminal:

BASH
sudo timeshift --create --comments "Clean system before kernel update"

Verify it exists before you trust it:

BASH
sudo timeshift --list

You should see your snapshot with a name and date. If the list is empty, something failed, and now is the time to find out, not after a broken update. Common causes are a full disk or an unmounted snapshot location.

Step 4: Restore from a running system

This is the easy case, and the one you will use most. If an update leaves your desktop glitchy but bootable, open Timeshift, select the snapshot from before the update, click Restore, and confirm. Reboot when it tells you to, and you are back where you were.

The terminal equivalent is interactive on purpose, so you cannot restore the wrong snapshot by typo alone:

BASH
sudo timeshift --restore

Pick the snapshot from the list it prints, confirm the target device, and let it work. Do not interrupt it: a half-restored system is worse than the broken one you started with. When it finishes, reboot and check that the problem is gone before you update again.

Step 5: Restore when the system will not boot

This is the scenario people set Timeshift up for. You need the same live USB you installed from, or any recent live image of your distro.

  1. Boot from the live USB and choose the "Try" session, not the installer.
  2. Connect to the internet and install Timeshift in the live session with the same command you used in Step 1. This is temporary; the live session forgets it on reboot.
  3. Launch Timeshift. It will ask for the snapshot location: point it at the partition or drive where your snapshots live. Your snapshots appear in the list.
  4. Select the last known-good snapshot and click Restore. Timeshift mounts your real root partition and restores into it.
  5. Reboot into your installed system, removing the USB when prompted.

Two gotchas: unlock an encrypted snapshot partition in the live session first, and do not reinstall the same update immediately after restoring, or you will break the system a second time. Restore, boot, check, then update again one package group at a time.

The habit that makes it work

Timeshift earns its keep through one boring habit: snapshot before you change something risky. Kernel update, driver swap, or a config file you are about to rewrite, take thirty seconds to create a named snapshot first. The schedule is just a safety net for the changes you forgot to announce.

Delete snapshots you no longer need from inside Timeshift, never by hand with rm, which leaves orphaned metadata behind. Pair that habit with a real file backup for your home directory, keep snapshots on the roomiest disk you have, and the next update that breaks your boot stops being a crisis. It becomes a restore, a reboot, and a story you tell instead of an evening you lose.

Sources

  • Timeshift project, GitHub: https://github.com/teejee2008/timeshift
  • Timeshift documentation and README, GitHub: https://github.com/teejee2008/timeshift/blob/master/README.md
  • Arch Wiki, Timeshift: https://wiki.archlinux.org/title/Timeshift