0

I recursively deleted the contents of my root directory with sudo privileges. My display reset, and windowing stopped working. I could no longer run non-buitin commands. Most of my directories (including the home directory disappeared).

What I meant to run:

sudo rm ./* -rf

What I believe I ran:

sudo rm /* -rf

I understand how this command works (see What does rm -rf do?).

I'm trying to get a better sense of how much (and what parts) of the original files and directory-structure physically remains on the hard-drive.

How much of these "remains" are recoverable? E.g is it possible to use data recovery software like TestDisk/PhotoRec to recover the full home dir itself? What about config files?

Community
  • 1
David Myers
  • 1

1 Answers1

1

What happened

That can be looked up in the man pages. rm deletes files and with the arguments -r (for recursively) and -f (for "forcefully").

In short it that command deletes every file (and directory) which is a child of that path. In your case /

Usually there should have been a warning about deleting your root directory (--no-preserve-root flag), though as I have never run that command myself (yet) I can't confirm if that happens everywhere.

How can I recover from an rm -rf

Data recovery isnt just running a few commands and be done with it. As the answer below states data recovery is a science.

Usually your best shot (best as in getting the most databack) if in fact everything was deleted is bare-metal recovery, though if it is financially viable is up to you to decide.

See this question over on serverfault for waht next steps to take: https://serverfault.com/questions/587102/monday-morning-mistake-sudo-rm-rf-no-preserve-root

Community
  • 1
zython
  • 367
  • @ zython This link is very helpful. I will look at the man pages in more depth, but I already understand what the command does on the surface level. I'm trying to get a better sense of actually changes when a directory is deleted. Since recovery remains an option, I presume only some "pointers" to each directory/file are deleted. I'd like to understand how such "pointers" are modified and what of the original structure remains. – David Myers Mar 02 '17 at 19:41
  • well here is the rm source code from the core utils, maybe this answers your question: http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=blob;f=src/rm.c;h=0dff18a4cdfcb20ce083062e87d0da41884dd3c1;hb=HEAD – zython Mar 02 '17 at 19:52