116
20
I had a folder I didn't want named '~', so from the command line I typed
rm -rf ~
and accidentally deleted my home folder (since ~ resolved to /home/username). Is there any way back or do I basically need to recreate the account from scratch?
Chris
Posted 2011-05-05T18:30:54.563
Reputation: 1 539
148
In general there is no easy way back.
You could restore from your daily backup.
RedGrittyBrick
Posted 2011-05-05T18:30:54.563
Reputation: 70 632
Put your +1 if you happen not to have your daily backup. – Martin Vseticka – 2015-06-11T07:43:56.867
@MartinVseticka nice try :) – markroxor – 2019-04-29T06:57:15.670
198Your remark on backups is cruel and 100% to the point. – Benjamin Bannier – 2011-05-05T19:29:28.610
3
OS X sets the bar for how backups should work (especially with Time Capsule). See http://maketecheasier.com/time-machine-for-ubuntu-try-timevault-and-flyback/2008/03/07 for suggestions how to get somewhat the same thing with Ubuntu.
– Thorbjørn Ravn Andersen – 2011-05-06T03:08:45.5404@Thorbjørn Ravn Andersen - It does, except when Time Machine has a nervous breakdown. I've had time machine have a freak-out on me twice in six months. – Fake Name – 2011-05-06T05:31:53.227
Offsite backup is great and can be pretty affordable. I use Backblaze (Mac/Windows) at $5/computer/month. Many people seem to like Crashplan (Mac/Windows/Linux).
– Henrik N – 2011-05-06T06:02:39.137@Fake Name, really? Has worked well for me. – Thorbjørn Ravn Andersen – 2011-05-06T06:43:36.977
23daily what ???? – Luc M – 2011-05-06T15:00:06.683
@LucM well, if you had a Mac - time machine, and all you need to know is to open it up when you need something restored. – Morgan Wilde – 2013-09-17T14:51:18.390
67
Others (such as @RiMMER, @Adam, and @James T) have mentioned that, for most filesystems, it's possible to recover most or all of your data (perhaps without filenames), because the data is not actually zeroed out, only removed from the file-table. This is not just true of Linux - the same is true of Windows and Mac.
However, no one has mentioned the most important thing - TURN OFF YOUR COMPUTER. NOW..
Many programs - including the internet browser you're using right now - will cache data to the hard-drive, and pretty much anything you do can cause your computer to resize/write to the swap file. Both of these things will write to free sectors on the hard drive, potentially overwriting your precious data.
Thus, turn off your computer, take out the hard-drive, and put it in another computer. Mount the hard-drive as read-only, and recover the files onto a separate hard-drive. When you've recovered everything you can of interest - and only then - write the files back to the original drive.
BlueRaja - Danny Pflughoeft
Posted 2011-05-05T18:30:54.563
Reputation: 7 183
12Even the process of shutting down can write to the hard-drive. I'm hesitant to recommend immediately unplugging your computer, because that can definitely make things much worse, but... well, depending on how important the data is, you might want to consider it. – BlueRaja - Danny Pflughoeft – 2011-05-06T02:24:46.687
1Depending on the drive/OS/mount point it may be possible to immediately unmount and/or remount readonly live without turning the pc off, then shutting down etc. – Matthew Scharley – 2011-05-06T03:48:38.313
1killall rm instead of turning off. – Fred Nurk – 2011-05-06T07:19:17.400
1Depending on how big your home directory was and how big your hard drive is, the chances of over-writing the free sectors which contains your data is pretty slim. – MSpeed – 2011-05-06T08:27:47.777
You can recover text files using this method without a lot of difficulty (as long as you have a rough idea of whats in them), but binary files are so difficult as to be basically impossible. – Satanicpuppy – 2011-05-06T14:36:20.873
@Satanicpuppy: That depends on circumstances (particularly on the FS in use). I once accidentally deleted an 800MB video file, and was able to undelete it without any data loss - however that was on a separate partition without any regular write activity. So it really depends (and for the record, the partition used Ext3). – sleske – 2012-01-04T11:06:01.187
13
I believe that every linux user at one point in time must learn this painful lesson firsthand before actually learning the importance of backups, as well as paying attention to detail and being careful.
For instance, if you're deleting wierd looking files, you could first run commands on that wierd file that have no side effects and that don't make changes to your data. For instance, had you run
cd ~
before trying to delete the folder, you would have seen that it would instead change directory to your home folder, not the ~ folder. Once you go through enough troubleshooting steps to learn the true command you would need to correctly cd into the ~ folder, then you could press your up arrow key to pull the last command from history and then change cd to rm and then and only then try to delete the folder.
I suggest taking steps like this before performing any action that is permanent. It's not permanent or foolproof, but you have a much better chance of preventing those oops moments if you take this degree of care when performing actions that have side effects.
jmort253
Posted 2011-05-05T18:30:54.563
Reputation: 1 381
4Look before you leap, and ls before you rm. – LawrenceC – 2012-03-31T01:42:13.573
6
You can try using testdisk to undelete individual files. This apperently only works on ext2 and NTFS (but still worth a try).
If you have ext3 or ext4, you can recover known files using photorec, which will probably end up recovering more than you want it to. Photorec recovers files without the filename information so it can be tedious to go through the files.
James T
Posted 2011-05-05T18:30:54.563
Reputation: 8 515
4
If you have a large enough external drive you have another possibly safest option. You will need enough space to store the entire home partition including free space.
Boot from a CD and don't mount the home drive at all. Mount the external drive. dd the home drive partition into a file on the external drive. mount the file as a loopback device do your undeleting work on this image, safe in the knowledge that you can't do any damage to your original filesystem. Depending on the filesystem there may be many things to try, some of them potentially destructive.
This saved me once with a beta version of Reiser4 when I didn't know what it would do even if I mounted it read only. I read somewhere at the time that journal writes were still possible.
It's also a good technique for saving data from a dying drive.
barrymac
Posted 2011-05-05T18:30:54.563
Reputation: 665
1+1 for mentioning that on most journaled FSs, even a readonly mount may write data as part of journal acitivities. – sleske – 2012-01-04T11:07:26.430
2
There are techniques to recover files by inspecting the inodes that have not been recycled. The more data that you write to the file system after the deletion, the less likely you are to recovery your data. The best strategy to recovery from an accidental data deletion is to restore from backup.
Xenoactive
Posted 2011-05-05T18:30:54.563
Reputation: 992
2
alias rm="rm -i"
Assuming you are using the Bash shell (put this in your .bashrc file so it persists to new shells you open).
This should result in rm asking you to confirm what you want to delete, which is nice especially when you are doing -rf, but it also will expand '~' to the full path to your home directory in the prompt, which should give you a clue you are not deleting a file '~' but actually your homedir.
$ rm -rf ~
rm: examine files in directory /nas/users/u12345/unix (yes/no)? n
This is not technically an answer to your question, but might help you avoid such problem in future.
EDIT: Some people may discourage you from using this technique as it makes you less careful with the "rm" command. In my experience this is far from the truth. In reality, the effect of the alias is to discourage you from using "rm -rf" - as you know it will result in many prompts you don't want to answer - and in order to get a no-prompt "rm -rf" you need to deliberately refer to the rm command as /bin/rm (or whatever). This leads to much more conscious and deliberate use of the "rm" command in general - as you always need to precede usage of rm with a mental choice of "rm or /bin/rm" - on both your server and any other you happen to be logged in to. And a world where everyone thought before using rm would be a safer one indeed!
aaa90210
Posted 2011-05-05T18:30:54.563
Reputation: 151
2Depends on the system you're on. On RHEL5 and OS X 10.6 at least, -f overrides the -i option. – Daniel Beck – 2011-05-06T05:38:51.910
I did not know that. I append my advice with YMMV and "don't try this at home, or probably more importantly at work"! – aaa90210 – 2011-05-06T05:42:47.247
9If you do this, you will one day not have this alias in place – maybe you're sitting at another computer or you have ssh'd into somewhere – and you will use rm being used to the safety net. You will do something you regret. – Fred Nurk – 2011-05-06T07:04:12.800
1@FredNurk Exactly. Best bet is to just add the -i yourself, or just not use the -f option. – Arda Xi – 2011-05-06T13:06:54.293
When I have alot of files to delete, I begin with rm -i my_list_of_files. Then I use CTRL-C and recall my command to modify it to rm -rvf my_list_of_files – Luc M – 2011-05-06T15:03:30.610
2
I'm sorry about your data. Everybody else has chimed in with how to deal with your data problem, but here is some information on how you can deal with the next time you see a folder caled ~.
-rf or any mad powerful arguments to rm to do the delete. Instead take it nice and slow and make sure you can see what's happening. It's possible to enter the tilde without it expanding to your home directory by escaping it on in the shell. In theory you could rm -rI \~, however you can go one step further.
cd \~ to get INTO that folder, maybe even use pwd to check that you got there. Ten remove it's contents while you're in there. Again be careful but clean out the folder with rf -rI * and if you need to get .* too.cd .. and remove the directory with rmdir \~.
Caleb
Posted 2011-05-05T18:30:54.563
Reputation: 4 323
1
Recovery Tools - Command Line :
Recovery Tools - Gui :
Infos :
In my personal experience i get my data back using "UFS Explorer" and photorec
(1) = Not open source, not free
(2) = Not open source, free
(3) = Open source and free
(4) = Have ntfs support
(5) = Have directory structure feature
intika
Posted 2011-05-05T18:30:54.563
Reputation: 839
1
I just cd .snapshot and restore the files. But, I do this at work and I have no idea whare the .snapshot directory comes from. I though maybe it was a Linux feature.
meBigGuy
Posted 2011-05-05T18:30:54.563
Reputation: 11
-3
rm is forever.
Although this doesn't help you now, you could in the future not use rm or to really force yourself, add a script found earlier in your path named rm that moves the files to a trash folder that you clean out some other time (allowing you to make mistakes and not be SOL).
Corey
Posted 2011-05-05T18:30:54.563
Reputation: 11
@Corey Although I agree that this could cause a bad habbit, +1 because this answer has been too heavily downvoted – John Militer – 2017-02-12T21:56:05.993
7Only problem with this is you may become a little fast and loose with the rm command and forget that you don't have the handy undelete functionality on your company Linux server... oops... – jmort253 – 2011-05-06T02:34:27.130
2-1 This has the same problem as over down-voted answers (so I'll steal someone else's comment): one day not have this script in place – maybe you're sitting at another computer or you have ssh'd into somewhere – and you will use rm being used to the safety net and you will do something you regret. – DMA57361 – 2011-05-06T16:33:37.813
I'm just curious: who created the folder named '~' which you found on your computer? – unforgettableidSupportsMonica – 2015-10-07T16:51:58.600
Where do I get my '"sudo rm -rf ~"-without-a-backup'-badge? I want to claim it right now. – Daniel F – 2016-01-14T15:30:18.540
Don't name folders "~"? ;-) – Craig – 2016-12-11T07:18:48.343
18What file system? – Tarnay Kálmán – 2011-05-05T18:39:03.353
1If you just want to restore your ability to login, login as root,
mkdir /home/{your username}, and thenchown {your username}:{your group} /home/{your username}. – LawrenceC – 2011-05-05T18:56:26.6576Clearly you people have no sense of humor. – Blomkvist – 2011-05-05T19:08:09.297
If you get in the habit of using
shredinstead ofrm, you should end up ok in the end. – Thomas Eding – 2011-05-06T03:42:32.67321Though this doesn't directly answer your question,
rm -rf "~"with quotes will look for that literal name instead of expanding it. But I would be scared to use that anyway – I would use something likelsorcdfirst to verify I get the right dir, or delete the folder from a GUI file manager. Perhaps first rename the dir (mv "~" tilde), verify and then remove. – Henrik N – 2011-05-06T05:58:56.7372
For the future, don't use rm interactively at the command line. Use a utility like trash and you 1) can't make the same mistake again and 2) can't get used to a poor shell alias of rm that will cause you trouble.
– Fred Nurk – 2011-05-06T07:06:44.357@Fred
rm -ir ~will printexamine files in directory /Users/danielbeck. It's safe enough for use like this. – Daniel Beck – 2011-05-06T07:18:49.9431@DanielBeck: If you have the discipline to always type the option, that works fine. In my experience, users are more likely to drop the option and go back to using rm directly. – Fred Nurk – 2011-05-06T07:22:34.743
9@HenrikN: ./~ instead of "~" does the same, but also works with other common problematic filenames, like those that start with dashes and look like options. – Fred Nurk – 2011-05-06T10:57:17.907
@FredNurk Just not using
-fis already an improvement. – Arda Xi – 2011-05-06T13:07:34.0171
Blomkvist As I reported and commented on your answer, I assume your comment was directed at me. Just post your non-answers (i.e. comments) as actual comments next time and nobody will care. They'll probably even help you get the Pundit badge. I liked the story and would have upvoted a comment.
– Daniel Beck – 2011-05-06T17:15:14.9701Like @Henrik N's comment this is not a solution either. But I always use
gvfs-trash(Ubuntu) even if I'm at the command line, instead ofrm. It can delete directories or files, and unlikermthere is a recovery option. I made analias del=gvfs-trashin my.bash_aliasesand alsoaliasedmvtomv -ito avoid the other kind of irreparable error. – isomorphismes – 2012-09-01T02:33:46.140Just be happy it wasn't
rm -rf /orrm -rf .... ;) – sjas – 2013-02-24T17:48:02.173