This question already has an answer here:

I recursively deleted the contents of my root directory with sudo privileges. My display reset, and windowing stopped working. I could no longer run non-buitin commands. Most of my directories (including the home directory disappeared).

What I meant to run:

sudo rm ./* -rf

What I believe I ran:

sudo rm /* -rf

I understand how this command works (see What does rm -rf do?).

I'm trying to get a better sense of how much (and what parts) of the original files and directory-structure physically remains on the hard-drive.

How much of these "remains" are recoverable? E.g is it possible to use data recovery software like TestDisk/PhotoRec to recover the full home dir itself? What about config files?

marked as duplicate by Sergiy Kolodyazhnyy, Elder Geek, karel, Eric Carvalho, muru Mar 5 '17 at 7:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • You're only a fool if you do it a second time. :-) – Mike Waters Mar 2 '17 at 18:54
  • @zython he/she is not just asking what it does, but how to recover as well. – Andrea Lazzarotto Mar 2 '17 at 19:06
  • You can recover with testdisk most of the data. But you will need to re-install anyway. – Pilot6 Mar 2 '17 at 19:24

What happened

That can be looked up in the man pages. rm deletes files and with the arguments -r (for recursively) and -f (for "forcefully").

In short it that command deletes every file (and directory) which is a child of that path. In your case /

Usually there should have been a warning about deleting your root directory (--no-preserve-root flag), though as I have never run that command myself (yet) I can't confirm if that happens everywhere.

How can I recover from an rm -rf

Data recovery isnt just running a few commands and be done with it. As the answer below states data recovery is a science.

Usually your best shot (best as in getting the most databack) if in fact everything was deleted is bare-metal recovery, though if it is financially viable is up to you to decide.

See this question over on serverfault for waht next steps to take: https://serverfault.com/questions/587102/monday-morning-mistake-sudo-rm-rf-no-preserve-root

  • @ zython This link is very helpful. I will look at the man pages in more depth, but I already understand what the command does on the surface level. I'm trying to get a better sense of actually changes when a directory is deleted. Since recovery remains an option, I presume only some "pointers" to each directory/file are deleted. I'd like to understand how such "pointers" are modified and what of the original structure remains. – D. Myers Mar 2 '17 at 19:41
  • well here is the rm source code from the core utils, maybe this answers your question: git.savannah.gnu.org/gitweb/?p=coreutils.git;a=blob;f=src/… – zython Mar 2 '17 at 19:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.