Undo sudo rm -R /*

Question

I stupidly ran sudo rm /* followed by sudo rm -R /*

My sites still run, although the vast majority of commands like ls are now broken. Is there a simple way to get data off the server or reverse some of damage?

Answer 1

There is no undo for sudo. It's a one time root runtime privilege. To better explain, it's like deleting your Win32 folder for Windows and wondering how to get it back. A simple re-install should fix your issue. I would recommend next time using man rm to better understand what the command does.

A simple reading of any terminal command before executing them would be in your best interest for you server, so no more unnecessary functions are carried out!

This should better Illustrate my meaning:

Answer 2

While there is no way to undelete the files

Your sites are still up so you can save the content from the browser. Of course if the sites are database driven then this will not help much.

But if your sites are mostly static html and they are still in memory, you can use some browser tool to save them from your browser.

There are some tools that can help with that, at the very least any browser can save complete html.

HTH

Answer 3

No, there is not a simple way to recover this data. A backup is the easiest way to get it back.

However there are some complicated ways, such as one discussed in this Questions' Answers. Although these may not work if the commands are indeed broken like you said.

If you've already gone too far for any of those methods, your next easiest method will likely be consulting from a data forensics professional or company.

When everything else fails, just do what you would do after 'nuking it from orbit.' AkA Re-install and get your old safe backup files.

Answer 4

You can restore the files but it will vastly depend on what has happened to the filesystem since you removed the files.

Linux will retain files that are open which is why your sites still run, but the second you end the process that hold the locks you will effectively lose the files.

The only likely way to recover the data is to shutdown and mount the disk 'read only' and use one of the many recovery tools, this thread has some excellent advice to give on this matter - https://unix.stackexchange.com/questions/122305/undelete-a-just-deleted-file-on-ext4-with-extundelete

i have recovered several TB with a commercial offering but for the life of me I cannot remember its name.

If you have no access to the server then you can recover currently locked files but the process is imperfect and you will want to do the recovery to a different volume to avoid trashing any files that are not currently open, and potentially retrievable using an undelete utility.

Some thing along the lines of:

tail -c +0 -f /proc/$pid/fd/$fd > filename

So iterate through all $pid's which have associated $fd's and you'll get a fair amount back.

Good luck!