I stupidly ran sudo rm /* followed by sudo rm -R /*
My sites still run, although the vast majority of commands like ls are now broken.
Is there a simple way to get data off the server or reverse some of damage?
-
1You mean like restoring from backup? – Jan Dec 1 '14 at 22:26
-
2There is no 'simple' way to do so, a backup is indeed your best option. Otherwise you may need some seriously professional data forensics workers. – Robobenklein Dec 1 '14 at 22:27
There is no undo for sudo. It's a one time root runtime privilege. To better explain its like deleting your Win32 folder for Windows and wondering how to get it back. A simple re-install should fix your issue. I would recommend next time reading MAN on rm to better understand what the command does
A simple reading of any terminal command before executing them would be in your best interest for you server, so no more unnecessary function are carried out!
This should better Illustrate my meaning
-
I hate myself for being so stupid. If I reinstall Ubuntu 12.04 will my data be gone? – Andrew Lynch Dec 1 '14 at 22:39
-
Only if the Part is shared with your data. If so, yes. To be honest here no server should share data and OS. – Virusboy Dec 1 '14 at 22:40
-
It's a dedicated server. So the entire server is mine. Hence why I was able to be so stupid. – Andrew Lynch Dec 1 '14 at 22:42
-
-
Its on a single drive :/ . Any idea how all my sites are still running? I assume if I restart is game over. – Andrew Lynch Dec 1 '14 at 22:49
While there is no way to undelete the files
Your sites are still up so you can save the content from the browser. Of course if the sites are database driven then this will not help much.
But if your sites are mostly static html and they are still in memory, you can use some browser tool to save them from your browser.
There are some tools that can help with that, at the very least any browser can save complete html.
HTH
No, there is not a simple way to recover this data. A backup is the easiest way to get it back.
However there are some complicated ways, such as one discussed in this Questions' Answers. Although these may not work if the commands are indeed broken like you said.
If you've already gone too far for any of those methods, your next easiest method will likely be consulting from a data forensics professional or company.
When everything else fails, just do what you would do after 'nuking it from orbit.' AkA Re-install and get your old safe backup files.
You can restore the files but it will vastly depend on what has happened to the filesystem since you removed the files.
Linux will retain files that are open which is why your sites still run, but the second you end the process that hold the locks you will effectively lose the files.
The only likely way to recover the data is to shutdown and mount the disk 'read only' and use one of the many recovery tools, this thread has some excellent advice to give on this matter - https://unix.stackexchange.com/questions/122305/undelete-a-just-deleted-file-on-ext4-with-extundelete
i have recovered several TB with a commercial offering but for the life of me I cannot remember its name.
If you have no access to the server then you can recover currently locked files but the process is imperfect and you will want to do the recovery to a different volume to avoid trashing any files that are not currently open, and potentially retrievable using an undelete utility.
Some thing along the lines of:
tail -c +0 -f /proc/$pid/fd/$fd > filename
So iterate through all $pid's which have associated $fd's and you'll get a fair amount back.
Good luck!
