rm -r *

[RogierEggers]

I assumed that I was in an unimportant directory when I issued this command, but I was in / !!

This is really stupid

I just turned off the since I couldn't give any commands anymore.

I do have a backup of my home-directory, but not of the system. So I have to either build it again or recover it somehow. I am now doing some study if I can recover, undelete some some files or more to save me the days it takes to rebuild the system (not so fast with celeron 533 mhz and slow internet).

Could you enlighten me on two subjects? Thanks

There is a lot that I read specifically about debugfs which gives me some hope. All files necessary to get my system functioning again were on evms volumes (except for /boot) with ext3 filesystems. Using a bootdisk with a kernel that supports evms and containing debugfs could maybe help me.

1) Is there a chance that since I just powered off my computer, the delete action was only performed and that I can recover the files by bypassing the journal somehow? Or does the kernel also immediately alter the filesystem "itself" when I give the rm command?

2) And another question. There are some howto's and descriptions on the net ( such as http://www.antipope.org/charlie/linux/shopper/152.html or http://www.samag.com/documents/s=1441/sam0111b/0111b.htm ) that describe how to recover files by searching free inodes with debugfs and then write the contents to another partition. This will effectively undelete the files. But what about the filenames. In my case it is offcourse impossible to investigate each file and guess its filename. So, I wonder, is there a known method that can recover file and folder names?

Thanks very much for the help.

Rogier

[pizen]

The data remains physically on the drive until it is overwritten. rm deletes the inode and lets the OS know that those blocks are free to be written over. The filenames are not kept in the inode but instead in the directory file (which is a mapping of filenames to inodes). I'm not sure how you'll get those back.

[RogierEggers]

Thanks for your reply.

But what about me powering off immediately? Does the kernel directly modify the inodes in ext3, or does it first modify the journal and modify the inodes later? When umounting for instance.

In the latter case I could be saved.

[pizen]

I don't think you're saved. The way journaling works is that the filesystem changes are kept in a log. During idle time a process commits these changes to the disk. This log is never cached so the changes are immediate to the filesystem. In the event of a crash (or your intential powerdown) when the system comes back up a process takes a look at the log and sees what was commited and what was pending. It then finishes commiting the log. Thus, the journal works in keeping the filesystem from being corrupt. However, you're still screwed. Since you powered down in the middle of the rm command it probably didn't get to delete all the files. So whatever rm didn't get to yet is probably still ok (because it never got written to the journal) but the other stuff is gone.

[really]

you can just try to boot it up like normaly. and see if therse complaints.

theres a chance that it like deleted the man pages or something like that, if you turned off 3 secs after the command then your all ok, if more than a minute you can expect missing files or no funcionalit at all, if more than 2 minutes i bet you have deleted a files needed for operation like bash or cat or /bin or /lib...
just test it, if it dosent boot up properly and doesnt let you login and then do some normal stuff then you need to rebuild :/
_________________
NoManNoProblem

Get lost before you get shot.

[mooman]

And if I can share a little bit of wisdom too late to be of use this time...

Never use wildcards when doing rm -r!

Use filename completion if you want (a few letters + TAB), but always stick something explicit out there...

If you're in the directory in question, first cd .., then rm -r dirname.

I've seen this happen to a few too many people to ever feel 100% confident trusting myself to never make a mistake... Of course I'm sure the average person only ever does this once before learning the lesson the hard way..
_________________
Linux user off and on since circa 1995

[pizen]

I would also suggest adding something to your shell prompt that tells you the full present working directory so that you know exactly where you are all the time.

[RogierEggers]

Well guys, I just started a new install... I did some more searching on how to recover filenames automatically. But I didn't find anything. Without such a utility it is offcourse impossible to recover an entire system with its many many files. Also did I just try to reboot, but it stops right after the kernel.

Thanks for the wise words. Athough I could have thought of them myself earlier offcourse! I think I will not forget about them very easily anymore. How come, I wonder. I certainly will avoid using wildcards when deleting (although I find it very convenient and quick) and I will get a package which provides me with sort of a trashcan. I've seen those around while I was searching for recovering utilities.

I praise myself lucky that my gentoo installation was still pretty new and not so much customised.

Thanks 'n Cheers

[pizen]

For a makeshift trashcan you could just alias rm as mv to a specific folder.

[Johto]

Its good to have alias for rm, example: alias rm='rm -iv'

But then again, when usind -i switch, its bad habit to start using -f too

[mooman]

Well, wildcards with just rm aren't particularly bad, but I'm claiming you need to condition yourself not to use them with rm -r. That's an order of magnitude greater risk...

Single files or even single directories can often be easily pulled from another box. Whole branches of the filesystem gets grisly...
_________________
Linux user off and on since circa 1995

[zhenlin]

I avoid this by making these small changes to /etc/profile: