I had a folder I didn't want named '~', so from the command line I typed
rm -rf ~
and accidentally deleted my home folder (since ~ resolved to /home/username). Is there any way back or do I basically need to recreate the account from scratch?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
Others (such as @RiMMER, @Adam, and @James T) have mentioned that, for most filesystems, it's possible to recover most or all of your data (perhaps without filenames), because the data is not actually zeroed out, only removed from the file-table. This is not just true of Linux - the same is true of Windows and Mac.
However, no one has mentioned the most important thing - TURN OFF YOUR COMPUTER. NOW..
Many programs - including the internet browser you're using right now - will cache data to the hard-drive, and pretty much anything you do can cause your computer to resize/write to the swap file. Both of these things will write to free sectors on the hard drive, potentially overwriting your precious data.
Thus, turn off your computer, take out the hard-drive, and put it in another computer. Mount the hard-drive as read-only, and recover the files onto a separate hard-drive. When you've recovered everything you can of interest - and only then - write the files back to the original drive.
I believe that every linux user at one point in time must learn this painful lesson firsthand before actually learning the importance of backups, as well as paying attention to detail and being careful.
For instance, if you're deleting wierd looking files, you could first run commands on that wierd file that have no side effects and that don't make changes to your data. For instance, had you run
before trying to delete the folder, you would have seen that it would instead change directory to your home folder, not the
~ folder. Once you go through enough troubleshooting steps to learn the true command you would need to correctly
cd into the
~ folder, then you could press your up arrow key to pull the last command from history and then change
rm and then and only then try to delete the folder.
I suggest taking steps like this before performing any action that is permanent. It's not permanent or foolproof, but you have a much better chance of preventing those oops moments if you take this degree of care when performing actions that have side effects.
If you have ext3 or ext4, you can recover known files using photorec, which will probably end up recovering more than you want it to. Photorec recovers files without the filename information so it can be tedious to go through the files.
If you have a large enough external drive you have another possibly safest option. You will need enough space to store the entire home partition including free space.
Boot from a CD and don't mount the home drive at all. Mount the external drive. dd the home drive partition into a file on the external drive. mount the file as a loopback device do your undeleting work on this image, safe in the knowledge that you can't do any damage to your original filesystem. Depending on the filesystem there may be many things to try, some of them potentially destructive.
This saved me once with a beta version of Reiser4 when I didn't know what it would do even if I mounted it read only. I read somewhere at the time that journal writes were still possible.
It's also a good technique for saving data from a dying drive.
alias rm="rm -i"
Assuming you are using the Bash shell (put this in your .bashrc file so it persists to new shells you open).
This should result in rm asking you to confirm what you want to delete, which is nice especially when you are doing -rf, but it also will expand '~' to the full path to your home directory in the prompt, which should give you a clue you are not deleting a file '~' but actually your homedir.
$ rm -rf ~ rm: examine files in directory /nas/users/u12345/unix (yes/no)? n
This is not technically an answer to your question, but might help you avoid such problem in future.
EDIT: Some people may discourage you from using this technique as it makes you less careful with the "rm" command. In my experience this is far from the truth. In reality, the effect of the alias is to discourage you from using "rm -rf" - as you know it will result in many prompts you don't want to answer - and in order to get a no-prompt "rm -rf" you need to deliberately refer to the rm command as /bin/rm (or whatever). This leads to much more conscious and deliberate use of the "rm" command in general - as you always need to precede usage of rm with a mental choice of "rm or /bin/rm" - on both your server and any other you happen to be logged in to. And a world where everyone thought before using rm would be a safer one indeed!
I'm sorry about your data. Everybody else has chimed in with how to deal with your data problem, but here is some information on how you can deal with the next time you see a folder caled
-rfor any mad powerful arguments to rm to do the delete. Instead take it nice and slow and make sure you can see what's happening. It's possible to enter the tilde without it expanding to your home directory by escaping it on in the shell. In theory you could
rm -rI \~, however you can go one step further.
cd \~to get INTO that folder, maybe even use
pwdto check that you got there. Ten remove it's contents while you're in there. Again be careful but clean out the folder with
rf -rI *and if you need to get
cd ..and remove the directory with
Recovery Tools - Command Line :
Recovery Tools - Gui :
In my personal experience i get my data back using "UFS Explorer" and photorec
(1) = Not open source, not free
(2) = Not open source, free
(3) = Open source and free
(4) = Have ntfs support
(5) = Have directory structure feature