LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-15-2013, 05:23 AM   #1
Jslo040809
LQ Newbie
 
Registered: Apr 2013
Posts: 8

Rep: Reputation: Disabled
Ran rm -rf *


Hello gurus. I've done the ultimate user error and ran rm -rf * as root on /root and I wiped out everything! What I'm not sure of is what directory I was on when I did rm but I lost everything and assume I was on /root. I freaked out and rebooted and booted to a live cd.
Ultimately I want to just recover what was on my desktop. I tried using extundelete and I get errors about magic number. I also tried testdisk and I got further by it showing me my deleted folders but no option to recover them. The disk still has 2 partitions and. Think the 1st partition might be the boot.
I come in here hoping to get some hope I can recover a directory and its content. I'm begging for guidance! Please let me know the additional info I can provide that may clue you in resolving my problem. Thanks for any help! I browse this site for a long time and its helped me plentiful.

Last edited by Jslo040809; 04-15-2013 at 05:24 AM.
 
Old 04-15-2013, 06:30 AM   #2
cantab
Member
 
Registered: Oct 2009
Location: England
Distribution: *buntu, Vector
Posts: 499

Rep: Reputation: 102Reputation: 102
PhotoRec will almost certainly be able to get your files back. You'll need a good-sized external drive to save them to though.
 
Old 04-15-2013, 12:47 PM   #3
Jslo040809
LQ Newbie
 
Registered: Apr 2013
Posts: 8

Original Poster
Rep: Reputation: Disabled
Thanks for the reply and suggestion but i already tried photorec and it would not work for my situation. Firstly, it recovers common file extensions such as jpg, png, avi, txt, rtf, etc. Sadly the files i lost are not all common. Secondly, the original file names are not retained and are named in some series of numbers followed by an exrension. It would take me months to sort all those files.
Would you happen to know is their is another program that can help my situation? Linux or windows app? Thanks!
 
Old 04-15-2013, 01:19 PM   #4
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 17,921

Rep: Reputation: 3690Reputation: 3690Reputation: 3690Reputation: 3690Reputation: 3690Reputation: 3690Reputation: 3690Reputation: 3690Reputation: 3690Reputation: 3690Reputation: 3690
Quote:
Originally Posted by Jslo040809 View Post
Thanks for the reply and suggestion but i already tried photorec and it would not work for my situation. Firstly, it recovers common file extensions such as jpg, png, avi, txt, rtf, etc. Sadly the files i lost are not all common. Secondly, the original file names are not retained and are named in some series of numbers followed by an exrension. It would take me months to sort all those files.
Would you happen to know is their is another program that can help my situation? Linux or windows app? Thanks!
No, there really isn't in this situation. You need to just rebuild your box, and restore your data from backups.
 
Old 04-15-2013, 01:43 PM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529
Quote:
Originally Posted by Jslo040809 View Post
I also tried testdisk and I got further by it showing me my deleted folders but no option to recover them.
Are you sure you followed the instructions: http://www.cgsecurity.org/wiki/TestD...file_for_ext2? Did you have another drive or stick present to save files to?


Quote:
Originally Posted by Jslo040809 View Post
Sadly the files i lost are not all common.
So what type of files are they exactly?


Quote:
Originally Posted by Jslo040809 View Post
It would take me months to sort all those files.
If the choice is between recovering files and not recovering anything this isn't a valid argument IMHO. And if you do have a backup (even partial) then for example piece-wise hashing (md5deep) may help sort things. To some extent though, because due to file system behavior and due to how header / footer carvers like Photorec, foremost (older) or scalpel (way old) operate you may count yourself lucky if you can manage partial recovery.
 
Old 04-15-2013, 02:13 PM   #6
Jslo040809
LQ Newbie
 
Registered: Apr 2013
Posts: 8

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by TB0ne View Post
No, there really isn't in this situation. You need to just rebuild your box, and restore your data from backups.
i was afraid that was going to be my only option. Another forehead flicker was it was my backup i oof'd up. i was in the middle of rebuilding when i realized i rm * my ext hdd. I know I know i should slap myself ..and i did.
 
Old 04-15-2013, 02:19 PM   #7
Jslo040809
LQ Newbie
 
Registered: Apr 2013
Posts: 8

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by unSpawn View Post
Are you sure you followed the instructions: http://www.cgsecurity.org/wiki/TestD...file_for_ext2? Did you have another drive or stick present to save files to?
i have. I tried that method. Also could these instructions work on an ext4 FS? Im thinking my results were unsuccessful was because I'm not using ext2.


So what type of files are they exactly?
i have several files to recover. iso, dmg, tzg, mkv, etc. Not all of them are recovered with testdisk unless i could be missing something



If the choice is between recovering files and not recovering anything this isn't a valid argument IMHO. And if you do have a backup (even partial) then for example piece-wise hashing (md5deep) may help sort things. To some extent though, because due to file system behavior and due to how header / footer carvers like Photorec, foremost (older) or scalpel (way old) operate you may count yourself lucky if you can manage partial recovery.
Yeah, youre right but the disk was 1tb and im trying to recover +800GB.

I tried extundelete and when I would run extundelete /dev/sda2 --restore-all (sda2 is an lvm) i get an error regarding "bad magic number". Is that something i can fix to get extundelete to work?
 
Old 04-15-2013, 02:42 PM   #8
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 16,818

Rep: Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408
a word of advice
next time do NOT !!! run as root !!!!

on a lot of current distros you can not even login to the gui as root ( without using the "pam" hack)

Only become root for very specific tasks then drop back down to your normal user account

for this i DO recommend loging in as root into the gui one time and once only
-- to set the root gui theme to "high contrast" or some other " hideous" theme that you HATE

that way at a very quick glance you KNOW you are using root

also if not set
set the root terminal color to something VERY noticeable
like RED

on opensuse this is default
the normal user is white
the root prompt is RED

that way you know if you are root or not
 
1 members found this post helpful.
Old 04-15-2013, 03:53 PM   #9
Nbiser
Member
 
Registered: Oct 2012
Location: Maryland
Distribution: Fedora, Slackware, Debian, Ubuntu, Knoppix, Helix,
Posts: 302
Blog Entries: 7

Rep: Reputation: 44
Quote:
Originally Posted by Jslo040809 View Post
Hello gurus. I've done the ultimate user error and ran rm -rf * as root on /root and I wiped out everything! What I'm not sure of is what directory I was on when I did rm but I lost everything and assume I was on /root. I freaked out and rebooted and booted to a live cd.
Ultimately I want to just recover what was on my desktop. I tried using extundelete and I get errors about magic number. I also tried testdisk and I got further by it showing me my deleted folders but no option to recover them. The disk still has 2 partitions and. Think the 1st partition might be the boot.
I come in here hoping to get some hope I can recover a directory and its content. I'm begging for guidance! Please let me know the additional info I can provide that may clue you in resolving my problem. Thanks for any help! I browse this site for a long time and its helped me plentiful.
Here you say that you can see your folders, but not recover them. Could you put a USB or an external HD in and copy and paste these files onto them? I have done this in the past with brilliant success.
 
Old 04-15-2013, 04:04 PM   #10
ruario
Senior Member
 
Registered: Jan 2011
Location: Oslo, Norway
Distribution: Slackware
Posts: 2,175

Rep: Reputation: 1172Reputation: 1172Reputation: 1172Reputation: 1172Reputation: 1172Reputation: 1172Reputation: 1172Reputation: 1172Reputation: 1172
I know this is not helpful now but perhaps for others or for you in the future. Commands like 'rm -fr *' are always high risk, even when run as a regular user. I understand that it is sometimes the quickest and simplest way to kill the contents of a directory and all subdirectores but if you really need to do this at least consider adding '-i' or '-I' to give you a chance to make absolutely sure.
 
Old 04-15-2013, 04:35 PM   #11
Lennie
Member
 
Registered: Aug 2012
Location: Sweden
Distribution: LFS, built with pacman
Posts: 329

Rep: Reputation: 62
Quote:
Originally Posted by Jslo040809 View Post
I also tried testdisk and I got further by it showing me my deleted folders but no option to recover them.
Go inside the folder and from there you can recover the files. With one keystroke (I think it's 'C') you can recover all files in one directory at a time. They will be copied to the directory you were in when you started testdisk.
 
Old 04-15-2013, 04:38 PM   #12
Jslo040809
LQ Newbie
 
Registered: Apr 2013
Posts: 8

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Nbiser View Post
Here you say that you can see your folders, but not recover them. Could you put a USB or an external HD in and copy and paste these files onto them? I have done this in the past with brilliant success.
I think you were much fortunate than I was ...and more skilled than i am because possibly i could be doing this wrong. Here are my steps on testdisk:

Code:
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

  TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
>Disk /dev/sda - 1000 GB / 931 GiB - ST31000333AS
 Disk /dev/sdb - 4127 MB / 3936 MiB - Kingston DataTraveler 2.0
 Disk /dev/mapper/live-osimg-min - 4294 MB / 4096 MiB (RO)
 Disk /dev/mapper/live-rw - 4294 MB / 4096 MiB
 Disk /dev/mapper/vg_testrhel-lv_home - 941 GB / 877 GiB - ST31000333AS
 Disk /dev/mapper/vg_testrhel-lv_root - 53 GB / 50 GiB - ST31000333AS
 Disk /dev/mapper/vg_testrhel-lv_swap - 4160 MB / 3968 MiB - ST31000333AS
 Disk /dev/dm-0 - 53 GB / 50 GiB - ST31000333AS
 Disk /dev/dm-1 - 941 GB / 877 GiB - ST31000333AS
 Disk /dev/dm-2 - 4160 MB / 3968 MiB - ST31000333AS
>[Previous]  [  Next  ]  [Proceed ]  [  Quit  ]
The disk I'm choosing is Disk /dev/mapper/vg_testrhel-lv_home - 941 GB / 877 GiB - ST31000333AS
This is the home directory that I want to recover data from. I got to proceed and I'm at the testdisk menu and I choose Advanced and then here is where i get options for "type" "Superblock" "list" "image create" "quit". I choose list and I can navigate to my home directory and the files/directories that were deleted are in red font. When I attempt to copy the files to an ext hdd it jut creates a file of the deleted directory in the ext hdd with a small data amount. I have followed the instructions on the website provided and some options such as "undelete" is not available for me to continue.

i attached pictures of the hdd and the partitions. Maybe doing the rm * caused more damage than I thought.

Here is also the error when I tried extundelete:

[root@localhost extundelete-0.2.4]# extundelete /dev/sda2 --restore-all
extundelete: Bad magic number in super-block when trying to open filesystem /dev/sda2

Please let me know if you need more info. Many thanks!
Attached Thumbnails
Click image for larger version

Name:	Capture.PNG
Views:	27
Size:	91.9 KB
ID:	12329   Click image for larger version

Name:	Capture2.PNG
Views:	22
Size:	102.6 KB
ID:	12330  
 
Old 04-15-2013, 04:41 PM   #13
Jslo040809
LQ Newbie
 
Registered: Apr 2013
Posts: 8

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Lennie View Post
Go inside the folder and from there you can recover the files. With one keystroke (I think it's 'C') you can recover all files in one directory at a time. They will be copied to the directory you were in when you started testdisk.
I tried to go into the red folder (deleted folder) but it would not allow me to. I did press c to copy and it just copied over a filename of the deleted directory with no data.

I must be missing something if this program has great success
 
Old 04-15-2013, 11:54 PM   #14
H5X00R
Member
 
Registered: Apr 2013
Posts: 39

Rep: Reputation: 1
I feel for you but without backups your data is gone. The rm -rf is a dangerous syntax to run if not careful.

Before I use the rm -rf on a directory or files, I double check where I am in the directory because there is no going back to undo.

You have to accept this as a life learn experience and hope it doesn't happen again. Please do backups, yes it boring, but it is a relief when you have backups to restore files when accidents happen.

I wish you luck.
 
Old 04-16-2013, 12:34 AM   #15
PTrenholme
Senior Member
 
Registered: Dec 2004
Location: Olympia, WA, USA
Distribution: Fedora, (K)Ubuntu
Posts: 4,186

Rep: Reputation: 346Reputation: 346Reputation: 346Reputation: 346
A thought: The files you're looking for a apparently in a logical volume group. Is it possible that you have snapshots of the LV? If so, you should be able to restore (some of) your files from the snapshot using the LVM tools. (I think that RHEL may automatically snapshot for you, but I don't use RHEl.)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
I ran the makefile. Now what do I do? Rituparna Linux - Newbie 8 06-25-2009 09:08 PM
Hi, I ran this following code...... need help on this. LinuxInfo Programming 1 10-06-2008 04:01 PM
i think i ran out of space simeandrews Linux - General 6 09-01-2005 03:54 PM
Can't get X to come up after I ran FSCK zLinuxz Linux - General 3 08-10-2005 04:51 PM
When is /etc/profile ran? mcostello1 Linux - Software 2 09-21-2004 11:18 AM


All times are GMT -5. The time now is 06:27 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration