Hello gurus. I've done the ultimate user error and ran rm -rf * as root on /root and I wiped out everything! What I'm not sure of is what directory I was on when I did rm but I lost everything and assume I was on /root. I freaked out and rebooted and booted to a live cd.
Ultimately I want to just recover what was on my desktop. I tried using extundelete and I get errors about magic number. I also tried testdisk and I got further by it showing me my deleted folders but no option to recover them. The disk still has 2 partitions and. Think the 1st partition might be the boot.
I come in here hoping to get some hope I can recover a directory and its content. I'm begging for guidance! Please let me know the additional info I can provide that may clue you in resolving my problem. Thanks for any help! I browse this site for a long time and its helped me plentiful.

PhotoRec will almost certainly be able to get your files back. You'll need a good-sized external drive to save them to though.

Thanks for the reply and suggestion but i already tried photorec and it would not work for my situation. Firstly, it recovers common file extensions such as jpg, png, avi, txt, rtf, etc. Sadly the files i lost are not all common. Secondly, the original file names are not retained and are named in some series of numbers followed by an exrension. It would take me months to sort all those files.
Would you happen to know is their is another program that can help my situation? Linux or windows app? Thanks!

No, there really isn't in this situation. You need to just rebuild your box, and restore your data from backups.

Are you sure you followed the instructions: http://www.cgsecurity.org/wiki/TestD...file_for_ext2? Did you have another drive or stick present to save files to?


So what type of files are they exactly?


If the choice is between recovering files and not recovering anything this isn't a valid argument IMHO. And if you do have a backup (even partial) then for example piece-wise hashing (md5deep) may help sort things. To some extent though, because due to file system behavior and due to how header / footer carvers like Photorec, foremost (older) or scalpel (way old) operate you may count yourself lucky if you can manage partial recovery.

i was afraid that was going to be my only option. Another forehead flicker was it was my backup i oof'd up. i was in the middle of rebuilding when i realized i rm * my ext hdd. I know I know i should slap myself ..and i did.

Yeah, youre right but the disk was 1tb and im trying to recover +800GB.

I tried extundelete and when I would run extundelete /dev/sda2 --restore-all (sda2 is an lvm) i get an error regarding "bad magic number". Is that something i can fix to get extundelete to work?

a word of advice
next time do NOT !!! run as root !!!!

on a lot of current distros you can not even login to the gui as root ( without using the "pam" hack)

Only become root for very specific tasks then drop back down to your normal user account

for this i DO recommend loging in as root into the gui one time and once only
-- to set the root gui theme to "high contrast" or some other " hideous" theme that you HATE

that way at a very quick glance you KNOW you are using root

also if not set
set the root terminal color to something VERY noticeable
like RED

on opensuse this is default
the normal user is white
the root prompt is RED

that way you know if you are root or not

1 members found this post helpful.

Here you say that you can see your folders, but not recover them. Could you put a USB or an external HD in and copy and paste these files onto them? I have done this in the past with brilliant success.

I know this is not helpful now but perhaps for others or for you in the future. Commands like 'rm -fr *' are always high risk, even when run as a regular user. I understand that it is sometimes the quickest and simplest way to kill the contents of a directory and all subdirectores but if you really need to do this at least consider adding '-i' or '-I' to give you a chance to make absolutely sure.

Go inside the folder and from there you can recover the files. With one keystroke (I think it's 'C') you can recover all files in one directory at a time. They will be copied to the directory you were in when you started testdisk.

I think you were much fortunate than I was ...and more skilled than i am because possibly i could be doing this wrong. Here are my steps on testdisk:

The disk I'm choosing is Disk /dev/mapper/vg_testrhel-lv_home - 941 GB / 877 GiB - ST31000333AS
This is the home directory that I want to recover data from. I got to proceed and I'm at the testdisk menu and I choose Advanced and then here is where i get options for "type" "Superblock" "list" "image create" "quit". I choose list and I can navigate to my home directory and the files/directories that were deleted are in red font. When I attempt to copy the files to an ext hdd it jut creates a file of the deleted directory in the ext hdd with a small data amount. I have followed the instructions on the website provided and some options such as "undelete" is not available for me to continue.

i attached pictures of the hdd and the partitions. Maybe doing the rm * caused more damage than I thought.

Here is also the error when I tried extundelete:

[root@localhost extundelete-0.2.4]# extundelete /dev/sda2 --restore-all
extundelete: Bad magic number in super-block when trying to open filesystem /dev/sda2

Please let me know if you need more info. Many thanks!

Attached Thumbnails

   

I tried to go into the red folder (deleted folder) but it would not allow me to. I did press c to copy and it just copied over a filename of the deleted directory with no data.

I must be missing something if this program has great success

I feel for you but without backups your data is gone. The rm -rf is a dangerous syntax to run if not careful.

Before I use the rm -rf on a directory or files, I double check where I am in the directory because there is no going back to undo.

You have to accept this as a life learn experience and hope it doesn't happen again. Please do backups, yes it boring, but it is a relief when you have backups to restore files when accidents happen.

I wish you luck.

A thought: The files you're looking for a apparently in a logical volume group. Is it possible that you have snapshots of the LV? If so, you should be able to restore (some of) your files from the snapshot using the LVM tools. (I think that RHEL may automatically snapshot for you, but I don't use RHEl.)