Accidentally deleted /usr directory

Question

I accidentally delete /usr directory in my Ubuntu 16.04 dual booted with Windows 8 system.

Now I am unable to start my computer through Ubuntu OS. Please recommend something so that I can start my computer.

Answer 1

The /usr is a really important path of a GNU/Linux system, it contains a lot of (necessary) binaries, libraries, sources, shared stuff, etc.

It's the larggest part of a system:

5.6G    /usr
0       /proc
37K     /root
80M     /boot
0       /sys
423M    /lib
8.0K    /mnt
68K     /tmp
4.0K    /lib64
14M     /sbin
712M    /var
12M     /bin
1.2M    /dev

I have 2097 packages installed on my Ubuntu machine while 2019 of them have files installed in /usr directory.

So it really doesn't worth the time to try reinstalling all these packages again to fix the issue, because it's somehow close to reinstalling the whole system again.

I've got an answer to the question: "Accidentally removed /bin. How do I restore it?" which you can use it for this situation too.

Simply to reinstall the packages, you have to chroot into your broken system, create a temporary /usr, get a list of all packages that have files installed in /usr using dpkg -S /usr then reinstall them or extract and copy the necessary files.

The other thing you can do is to use testdisk, you may be able to bring /usr back really fast, here is a step by step guide.

However I suggest you to get a backup of your files and reinstall the Ubuntu.

Answer 2

I stupidly deleted the entire /usr folder by accident today when I ignored the warnings about running caja as root!

I really didn't want to have to go down the reinstall route and I found it was all still in /home/$USER/.local/share/Trash/files (but no way to fix it at that point because sudo had gone).

I managed to recover it by booting from a Lubuntu live USB disk and then copying it back from Trash to where it should be. Thought I was going to have to mount the disk first but didn't even have to do that - /dev/sda1 was already mounted under a long temporary name in /media/lubuntu

Answer 3

Immediately shutdown your system to avoid overwriting the contents of the directory that used to be /usr. After doing this, prepare a live boot Linux distro, any one of the modern Linux distributions will suffice. I prefer to do this with Kali Sana - because the stock distribution has the package/s we want for the recovery process.

After completing the preparation, plug the live boot flash drive into the damaged box and boot from the flash drive. Now you can proceed with the recovery. Mind you this is not a sure method. Quite frankly I have never come across a method that will work every time.

Since the partition that contains the deleted /usr directory most likely has an ext3 or ext4 filesystem - given that the system is Ubuntu 16.04 - the first utility that we are going to implement is extundelete. If you have the package installed by default, you can simply skip to the recovery. However, if you don't have the package installed, install it by

sudo apt-get update
sudo apt-get install extundelete

after installing the package, you now need to find the name of the partition that contained the deleted /usr directory. After locating this partition name, in my case for the sake of explanation I will say my deleted directory was on /dev/sda1.

1. extundelete

First you need to change the current working directory to a directory on a partition which has enough free space to hold the recovered /usr directory. To find a directory with enough free space use the df -h command.

output of df -h

The typical /usr directory is close to 10 gigabytes in size, so choose a partition with at least this much free space. Perhaps you can use your Windows 8 partition. But before you can use the partition, you have to mount it. Since the Windows 8 OS is most likely on a NTFS partition, mount it by using the following commands - here I am assuming the partition name of the Windows 8 NTFS partition to be /dev/sda3.

sudo mkdir /mnt/windows_8
sudo mount -t ntfs /dev/sda3 /mnt/windows_8

Then change your current working directory to /mnt/windows_8 by cd /mnt/windows_8. Now change to a root shell by sudo -s and input your sudo password.

The final restoration is done in the following manner. extundelete --restore-directory /usr /dev/sda1. If this method works, there will be a subdirectory of your current working directory called RECOVERED_FILES which contains the recovered files i.e. the directory /usr and its contents.

2. testdisk

This is a bit more interactive and works exceptionally well with freshly deleted files and directories - and has the added benefit of working with virtually all ubiquitous filesystem and partitioning architectures. Again, if you already have the package in your distro, go on to the recovery portion of this text. However, if you don't, install it by sudo apt-get install testdisk. The first step in the recovery process is creating an output directory for the recovered files and directories. To do this use

mkdir /mnt/windows_8/REC

Then in a root shell, open testdisk as,

sudo testdisk /dev/sda1

This will open an interactive CLI window. Press Enter to Proceed. Then select None to declare the disk as a non-partitioned media. Press enter to move to the next page. The choose Advanced. Then Press → to highlight List and press Enter. This will list the contents of the /dev/sda1 partition and you can navigate the program's window by following the Help info at the bottom and top of the screen and easily recover your files. In testdisk, deleted files and directories appear in red. Use the directory you created earlier i.e. /mnt/windows_8/REC to output the recovered files.

Both of these methods work better on freshly deleted partitions and filesystems. The more you wait to shutdown your system after inadvertently deleting a file or a system, the more likely is the chance of losing the files/directories for good.