I stupidly ran sudo rm /* followed by sudo rm -R /*

My sites still run, although the vast majority of commands like ls are now broken. Is there a simple way to get data off the server or reverse some of damage?

  • 2
    You mean like restoring from backup?
    – Jan
    Dec 1, 2014 at 22:26
  • 4
    There is no 'simple' way to do so, a backup is indeed your best option. Otherwise you may need some seriously professional data forensics workers. Dec 1, 2014 at 22:27
  • 1
    If you have no backups, you're hosed. No chance of restoring from this type of action if you don't have backups.
    – Thomas Ward
    Aug 8, 2021 at 18:13

4 Answers 4


There is no undo for sudo. It's a one time root runtime privilege. To better explain, it's like deleting your Win32 folder for Windows and wondering how to get it back. A simple re-install should fix your issue. I would recommend next time using man rm to better understand what the command does.

A simple reading of any terminal command before executing them would be in your best interest for you server, so no more unnecessary functions are carried out!

This should better Illustrate my meaning:

enter image description here

  • I hate myself for being so stupid. If I reinstall Ubuntu 12.04 will my data be gone? Dec 1, 2014 at 22:39
  • 1
    Only if the Part is shared with your data. If so, yes. To be honest here no server should share data and OS.
    – Virusboy
    Dec 1, 2014 at 22:40
  • It's a dedicated server. So the entire server is mine. Hence why I was able to be so stupid. Dec 1, 2014 at 22:42
  • Yes but does your server have one hard drive/one Partition?
    – Virusboy
    Dec 1, 2014 at 22:43
  • 1
    Your data is already gone, lol
    – Panther
    Dec 2, 2014 at 2:55

While there is no way to undelete the files

Your sites are still up so you can save the content from the browser. Of course if the sites are database driven then this will not help much.

But if your sites are mostly static html and they are still in memory, you can use some browser tool to save them from your browser.

There are some tools that can help with that, at the very least any browser can save complete html.



No, there is not a simple way to recover this data. A backup is the easiest way to get it back.

However there are some complicated ways, such as one discussed in this Questions' Answers. Although these may not work if the commands are indeed broken like you said.

If you've already gone too far for any of those methods, your next easiest method will likely be consulting from a data forensics professional or company.

When everything else fails, just do what you would do after 'nuking it from orbit.' AkA Re-install and get your old safe backup files.


You can restore the files but it will vastly depend on what has happened to the filesystem since you removed the files.

Linux will retain files that are open which is why your sites still run, but the second you end the process that hold the locks you will effectively lose the files.

The only likely way to recover the data is to shutdown and mount the disk 'read only' and use one of the many recovery tools, this thread has some excellent advice to give on this matter - https://unix.stackexchange.com/questions/122305/undelete-a-just-deleted-file-on-ext4-with-extundelete

i have recovered several TB with a commercial offering but for the life of me I cannot remember its name.

If you have no access to the server then you can recover currently locked files but the process is imperfect and you will want to do the recovery to a different volume to avoid trashing any files that are not currently open, and potentially retrievable using an undelete utility.

Some thing along the lines of:

tail -c +0 -f /proc/$pid/fd/$fd > filename

So iterate through all $pid's which have associated $fd's and you'll get a fair amount back.

Good luck!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .