Did I just rm -rf my entire home dir? (data recovery)
 

Hi everyone, I hope you're all well, I've made a pretty stupid error and I hope someone can help, thanks for your time.

So, I had been warned by gnome and my package manager that my HDD was full which didn't seem right so I decided to look at Gnome's 'Disk Usage Analyzer' which made the problem appear obvious. There was apparently a complete 1.5TB copy of my home directory in the /srv/nfs/ directory, now I don't have much use for NFS anymore and I needed to install some software so I thought the solution was quite straightforward :rolleyes:, I cd'ed to /srv/nfs/ and rm -rf'ed the directory and figured that I would fix nfs at a later date. Now this seems to have deleted my actual home directory, which is completely empty and it looks to me like I've lost ~1.5TB of data.
So firstly, Is it actually this operation which deleted my home directory or did I manage to do this at some other point with some other command?
And secondly do I have any chance of recovering files? I tried to unmount the partition when I realised what I had done but I kept getting an error to the effect that the drive was busy at which point I rebooted and got the same error, so I unplugged the machine. Googling led me to extundelete but I don't have access to another linux machine at the moment, would this be my best chance?

Thanks again for any replies.

Chances are /srv/nfs was just a link (bind mount? nfs mount?) to your home directory, so they were one and the same. When you deleted one, it deleted the other, since they were the same all along.

How big is your disk? How big did the disk utility say /home was? If you only have a 2 TB disk and it said both /srv/nfs and /home were each 1.5 TB, it should have been pretty obvious that there's some linking going on.

Either way, step one in this scenario is to unmount the hard drive and do NOT re-mount it until you're ready to lose everything that's on it. It looks like this is essentially what you did, so that's good.

Now, you need to get yourself an external drive with enough capacity to hold everything on the drive you want to recover. Boot up a live CD/DVD/USB, do NOT mount the "deleted" drive, and use testdisk/photorec to try and recover what you can off of the platters, dumping the rescued files to the external drive. Start with testdisk since it's better at preserving file names, if it's not successful photorec does work, but you'll lose your names (the files will be named after the inode in which they were found).

next time you will think twice about using"rm -rf"

remove
+
FORCE!!!
+
recursive

if you have a second computer
and FORCED a hard shout down the EXACT second you realized you oopsed

"photorec" and a few other tools ? might?
be able to recover SOME THINGS

on a different computer have a look at "systemRescueCD"
http://www.sysresccd.org/SystemRescueCd_Homepage
and photorec with testdisk
http://www.cgsecurity.org/wiki/PhotoRec

Hi,
thanks! I'll let you know how it goes. one question though, If I use an ubuntu live CD do I need to worry about ubuntu automounting the drive?

A Ubuntu liveCD should be ok - it may not have photorec, but you should be able to install it (in the liveCD environment will be safe). Likewise you can safely build extundelete.
However, you will need another (preferably bigger) disk to recover to - go get an external and "cd" into that before attempting recovery. You must ensure you are not writing to the original disk.

There is a way to avoid all this angst ...