Home / ubuntu / Questions / 798219
Accepted
azerafati
Asked: 2016-07-14 08:10:01 +0800 CST

I accidentally tried to remove all files from the root path

  • 772

I was working on a folder with write permissions on terminal when I tried to clean the current directory and start over using 

sudo rm -r ./*

But it took some time to finish which made me wonder and that was when I saw that I'm not on the folder I was expecting and I'm actually on the root path, so I just hurriedly aborted using Ctrl+C.

  • Ubuntu is working now, So I'm assuming no real harm was done, right?
  • How can I know what was deleted meanwhile?
  • Is there a way to fix Ubuntu to compensate for what was lost?
  • Is there a way of somehow keeping this from happening again? say an extra prompt whenever I try to remove more than 100 files?
data-recovery

3 Answers

  1. Best Answer

    Hopefully you have a LiveUSB or LiveCD to boot from. In the event that you did end up deleting enough to crash your system, you can boot to a Live media and select "Try Ubuntu".

    There are some option to "undelete" files with programs like extundelete, photorec, foremost and scalpel. But some of these can become a nightmare to use, especially if you're not even sure what got deleted.

    Another option that I recommend is to reinstall, and preserve your /home directory.

    Once booted to your Live media, you now have the opportunity to make a backup of your /home folder, provided it wasn't already deleted. If you /home folder was deleted, you may want to consider using one of the above mentioned software if you feel that the files were really important.

    Otherwise, go ahead and make a backup copy of your /home folder to another disk such as a USB stick, or another internal disk if you have one.

    Use rsync to do this like so rsync -avz /home /location/of/where/youre/backing

    Now in the Live session, there should be a shortcut on the launcher or the desktop called "Install Ubuntu". If not, just reboot again to the Live media and select "Install Ubuntu".

    In the installation portion, when you reach the partitioning page, click on "Something Else". Here you will see your partitions. Edit the one that had your Ubuntu installed to it, and set it as the same format as before (ext2/3 etc) and mount as root (/). Ensure the checkbox to format is UNCHECKED!

    Do the same thing with your SWAP partition. If you had a your /home folder or any other folders mounted on other partitions, make sure you also select those to be remounted how they were before. Again, with the format option unchecked.

    Continue with the installation. This installation will reinstall the entire OS, and will overwrite everything but it will NOT delete anything in your /home folder or anywhere else. So all your files will still be there. When you get to the last part of the installation to create a user, make sure you use the exact same username and same password.

    Reboot and see if all your files and settings are there. You may have to reinstall some programs, but you'll find that after you install the programs, all your settings will still be there. Example is if you reinstall Chrome, your history, bookmarks etc will appear.

    If you ARE missing files, boot back into the Live media, plug in or mount the drive where you made a backup of your home folder, mount your Ubuntu partition, and do rsync the other way around.

    rsync -avz /location/of/your/backup/home /location/of/your/mounted/ubuntu

    This should restore everything.

    • 8

  2. Stop using the computer so that you don't overwrite any deleted data on the hard drive, and shut it down.

    Get a LiveUSB, boot from it and install Testdisk. Use Testdisk to try and recover your partitions and files. Copy any important data to another flash drive, not the LiveUSB. Open the Ubuntu installer and install Ubuntu.

    I have personally used Testdisk and have had some luck with it. While it may work, it also may not. Please don't think of this as the cure-all for deleted files, because it isn't. Don't rely on it and think you're safe running rm no matter what, because the chance of full recovery is nowhere near 100%. With that said, if you haven't used the computer since running rm, you have a high chance of at least a partial recovery: enough to get your data.

    Even if you had let rm complete, you might not have even noticed any issues with Ubuntu right away. You would probably still be able to use any open programs. Trying to open anything would result in errors. Continuing to use Ubuntu when all your files have been deleted is a bad idea, however, as new data might overwrite the old, ruining your chances of recovery.

    • 5

  3. It's highly unlikely that command went through on a modern Ubuntu without the following:

    $ rm -rf /
/bin/rm: it is dangerous to operate recursively on '/'
/bin/rm: use --no-preserve-root to override this failsafe

    rm would likely continue to remove everything in $HOME which you do have write access to, but the rest of / is probably preserved.

    The other answers, however, are absolutely correct as well, and caution should be taken to preserve what you can.

    • 2