I accidentally tried to remove all files from the root path

Question

I was working on a folder with write permissions on terminal when I tried to clean the current directory and start over using

sudo rm -r ./*

But it took some time to finish which made me wonder and that was when I saw that I'm not on the folder I was expecting and I'm actually on the root path, so I just hurriedly aborted using Ctrl+C.

Ubuntu is working now, So I'm assuming no real harm was done, right?
How can I know what was deleted meanwhile?
Is there a way to fix Ubuntu to compensate for what was lost?
Is there a way of somehow keeping this from happening again? say an extra prompt whenever I try to remove more than 100 files?

You can delete everything in root and Ubuntu will mostly work fine until you reboot. — TheWanderer, Jul 13 '16 at 16:11
Possible duplicate of Made a huge mistake and deleted my /home/user folder (Ubuntu 14.04 LTS) — Andrea Lazzarotto, Jul 14 '16 at 18:18
@AndreaLazzarotto, the question you linked to is similar in nature but is not asking the 4 points I mentioned here and in that question the user let rm to finish but in this questions's case it was interrupted which might need different approaches — azerafati, Jul 16 '16 at 07:38
@azerafati the answer of the linked question clearly explains how to recover the deleted files, while the accepted answer here assumes that your home was not touched at all (something that definitely cannot be assumed until you check with proper tools). — Andrea Lazzarotto, Jul 16 '16 at 12:29
@AndreaLazzarotto I have other important points which I want to find out about them, like how to stop this from happening again. the accepted answer here is not complete it was just better than others, if someone answers better I'll accept that — azerafati, Jul 17 '16 at 09:47
Sorry if it sounds rude, but in order to avoid pruning all files from the root you should avoid typing a command that does exactly that. rm already has a check if you add -I (prompt if deleting more than 3 files) and if you try to rm over /. — Andrea Lazzarotto, Jul 17 '16 at 13:33
@AndreaLazzarotto, that's great I didn't know about that argument, wonder why it's not enabled by default — azerafati, Jul 17 '16 at 15:15
@azerafati I am not sure, but my speculation is that it is not enabled by default because it's extremely annoying to confirm every time you want to delete a bunch of files. — Andrea Lazzarotto, Jul 17 '16 at 15:49

Delorean · Accepted Answer · 2016-07-13T16:57:12.873

Hopefully you have a LiveUSB or LiveCD to boot from. In the event that you did end up deleting enough to crash your system, you can boot to a Live media and select "Try Ubuntu".

There are some option to "undelete" files with programs like extundelete, photorec, foremost and scalpel. But some of these can become a nightmare to use, especially if you're not even sure what got deleted.

Another option that I recommend is to reinstall, and preserve your /home directory.

Once booted to your Live media, you now have the opportunity to make a backup of your /home folder, provided it wasn't already deleted. If you /home folder was deleted, you may want to consider using one of the above mentioned software if you feel that the files were really important.

Otherwise, go ahead and make a backup copy of your /home folder to another disk such as a USB stick, or another internal disk if you have one.

Use rsync to do this like so rsync -avz /home /location/of/where/youre/backing

Now in the Live session, there should be a shortcut on the launcher or the desktop called "Install Ubuntu". If not, just reboot again to the Live media and select "Install Ubuntu".

In the installation portion, when you reach the partitioning page, click on "Something Else". Here you will see your partitions. Edit the one that had your Ubuntu installed to it, and set it as the same format as before (ext2/3 etc) and mount as root (/). Ensure the checkbox to format is UNCHECKED!

Do the same thing with your SWAP partition. If you had a your /home folder or any other folders mounted on other partitions, make sure you also select those to be remounted how they were before. Again, with the format option unchecked.

Continue with the installation. This installation will reinstall the entire OS, and will overwrite everything but it will NOT delete anything in your /home folder or anywhere else. So all your files will still be there. When you get to the last part of the installation to create a user, make sure you use the exact same username and same password.

Reboot and see if all your files and settings are there. You may have to reinstall some programs, but you'll find that after you install the programs, all your settings will still be there. Example is if you reinstall Chrome, your history, bookmarks etc will appear.

If you ARE missing files, boot back into the Live media, plug in or mount the drive where you made a backup of your home folder, mount your Ubuntu partition, and do rsync the other way around.

rsync -avz /location/of/your/backup/home /location/of/your/mounted/ubuntu

This should restore everything.

TheWanderer · Answer 2 · 2016-07-13T17:10:54.403

Stop using the computer so that you don't overwrite any deleted data on the hard drive, and shut it down.

Get a LiveUSB, boot from it and install Testdisk. Use Testdisk to try and recover your partitions and files. Copy any important data to another flash drive, not the LiveUSB. Open the Ubuntu installer and install Ubuntu.

I have personally used Testdisk and have had some luck with it. While it may work, it also may not. Please don't think of this as the cure-all for deleted files, because it isn't. Don't rely on it and think you're safe running rm no matter what, because the chance of full recovery is nowhere near 100%. With that said, if you haven't used the computer since running rm, you have a high chance of at least a partial recovery: enough to get your data.

Even if you had let rm complete, you might not have even noticed any issues with Ubuntu right away. You would probably still be able to use any open programs. Trying to open anything would result in errors. Continuing to use Ubuntu when all your files have been deleted is a bad idea, however, as new data might overwrite the old, ruining your chances of recovery.

score 2 · Answer 3 · answered Jul 13 '16 at 20:19

2

It's highly unlikely that command went through on a modern Ubuntu without the following:

$ rm -rf /
/bin/rm: it is dangerous to operate recursively on '/'
/bin/rm: use --no-preserve-root to override this failsafe

rm would likely continue to remove everything in $HOME which you do have write access to, but the rest of / is probably preserved.

The other answers, however, are absolutely correct as well, and caution should be taken to preserve what you can.

answered Jul 13 '16 at 20:19

cat

1,672

1

Unfortunately I don't think --no-preserve-root applies here – that only operates if you actually try to delete /, whereas the OP tried to delete './*' while located in the root directory. The shell expands that to rm -r ./bin ./boot ./dev ./etc ... before rm gets the parameters at all, so it never tries to actually delete /. (That said, of course, I haven't actually tried it!) – Soren Bjornstad Jul 13 '16 at 22:40
@SorenBjornstad You are, of course, completely correct, I'm not sure if I should delete this now – cat Jul 13 '16 at 22:52

I accidentally tried to remove all files from the root path

3 Answers3