Recovery after rm -rf /

[perlhacker14]

A friend of mine was trying Linux (not Debian, but Ubuntu), but this scenario is universal. He was told by someone to type sudo rm -rf / and to authenticate to update his system. The fool obeyed, and over half his harddrive is gone, with all his important files. His system is broken. Is there anything short of reinstalling that he can do?

[llivv]

'

[perlhacker14]

if he was/is using a journaling file system he could try to restore the data he " rm -rf / ed" from the superblocks.
Good Luck!

I suppose that would include the Ubuntu default ext3?
If so, then how would you reccommend starting? As soon as he realized what was happenning, my friend crashed his computer and rebooted before calling me.

[llivv]

'

[sinical]

- get that netinst disc out

[perlhacker14]

- get that netinst disc out

Netinst?? I didnot use that, and Unbuntu has not one of those. In the mean time, we are attempting to read from what is left, unfortunately most of the /etc directory is gone .
http://recover.sourceforge.net/linux/recover/ and http://recover.sourceforge.net/unix/ and ftp://pit-manager.mit.edu/pub/delete/ are quite help ful. I am waiting for his call on what happend.

[GraphiteCube]

I wonder why Linux doesn't have system file protection...

[Lavene]

I wonder why Linux doesn't have system file protection...

It does, it's called "Don't do stuff as root without knowing what you're doing!"

That said, assholes telling noobs to trash their system seriously need to get professional help because something is obviously wrong with them...

[sinical]

its harsh but seeing as it didnt happen to me, its funny

[chrismortimore]

If he is using ext3, the word is "buggered". From what I've read (and tried) it is basically impossible for us normal people to recover data from a vanilla ext3 filesystem. There are tools out there that try and get around this (their name skips me), but I don't trust them. I just backup regularly. The entire system backs up weekly, and all important stuff is backed up hourly on two separate computers (laptop and desktop).

[987687]

I got a computer the other day from a friend, he installed ubuntu on it and said it wasn't working. rm -fr / and a debian netinstall cd fixed the problem

[sinical]

I got a computer and ____ wasn't working. rm -fr / and a debian netinstall cd fixed the problem.

That should be a sig

[AgenT]

Netinst?? I didnot use that, and Unbuntu has not one of those. In the mean time, we are attempting to read from what is left, unfortunately most of the /etc directory is gone

Netinstall is one of the install disc types for Debian. It is very small (160MB).

You can also recover data "by hand", even without a journal but unless you have very important data, it is not worth the effort. It does take a long time. You can automate things, but you need to know bash scripting pretty well. If government and business agencies can do it, so can you.

Also notice that you are on the Debian forum and Debian is NOT Ubuntu. Although whatever applies to Debian in terms of file recovery will apply to Ubuntu (except Debian, like almost every other distro, uses su instead of sudo by default).

I hope the person who told your friend to use "rm -rf" was NOT anyone on this forum. Also, so that your friend is not fooled again, the man page should always be used to find out what is about to be done. It has the great benefit of teaching about GNU/Linux. man rm would have quickly made clear the impending doom.

[sleepyEDB]

My 'step 2' after either getting the existing install fixed or reinstalling (if need be) would be tracking down the person that told me to 'sudo rm -rf /' and show them just how appreciative of their advice I am.



sleepy

[perlhacker14]

Netinst?? I didnot use that, and Unbuntu has not one of those. In the mean time, we are attempting to read from what is left, unfortunately most of the /etc directory is gone

Netinstall is one of the install disc types for Debian. It is very small (160MB).

You can also recover data "by hand", even without a journal but unless you have very important data, it is not worth the effort. It does take a long time. You can automate things, but you need to know bash scripting pretty well. If government and business agencies can do it, so can you.

Also notice that you are on the Debian forum and Debian is NOT Ubuntu. Although whatever applies to Debian in terms of file recovery will apply to Ubuntu (except Debian, like almost every other distro, uses su instead of sudo by default).

I hope the person who told your friend to use "rm -rf" was NOT anyone on this forum. Also, so that your friend is not fooled again, the man page should always be used to find out what is about to be done. It has the great benefit of teaching about GNU/Linux. man rm would have quickly made clear the impending doom.

After being up past 2 in the morning on the phone, we gave up. All that was lost (of his files) was some programs he wrote and old homework.
Anyway, the jerk who told Greg (my friend who lost his HDD) to rm -rf / finds this whole thing very amusing. I do wonder why Greg listened to him in the first place, when the jerk has written atleast 3 virii and 2 keyloggers and the like. In the end, I only hope the good for nothing loser gets whats coming, and someday has to lose as much sleep as I did!

[alleluia20]

Other ways of spoiling a Linux system (one of the following commands is enough ):

cat /dev/[urandom | random | zero ] > /dev/[hda - sda - ..]

chmod -R 777 /

chmod -R 000 /

apt-get remove –purge libc6

:> /etc/password && :> /etc/shadow && :> /etc/inittab && :> /etc/fstab

rm /usr/lib/libstdc++.so.6



What I do not understand is why rm doesn't ask for confirmation by default. What happens if I want to run rm -rf /home/me/foo but I press accidentally Enter after the first / ?

[Lavene]

What I do not understand is why rm doesn't ask for confirmation by default. What happens if I want to run rm -rf /home/me/foo but I press accidentally Enter after the first / ?

- Don't do it as root
- Make a habit of using -i
- Make an alias for rm with the -i option

This is Linux... it behaves as you tell it to behave

Tina

[diego1116]

What I do not understand is why rm doesn't ask for confirmation by default. What happens if I want to run rm -rf /home/me/foo but I press accidentally Enter after the first / ?

That's why you should use "rm /home/me/foo -rf" instead.

I learn that a while ago in other topic. Thanks, AgentT.

[alleluia20]

That's why you should use "rm /home/me/foo -rf" instead.

That's a terrific piece of advice. Thank you

And thanks to Tina too for the information about the -i option. I could also have made man rm , of course

By the way (off-topic), Tina: in the KDE start up advices, you can read the countries where you can find KDE developpers, they list a large list of countries, and they finish with "even in Norway". Are you upset about this even?

[987687]

the f switch on rm means do what I say weather it is smart or not. Without the f it will ask for conformation.