I just ran rm /* accidentally, any fix?

Question

I fell so stupid...

I just ran rm /* accidentally, but I meant rm ./* on a cloud server with root access.

Now, no one command works. ls, ssh, sftp... none.

Is there a way to fix that? (Note: params like -r or -f are no used in this case).

Answer 1

Restore from backup.

Depending on the filesystem you may be able to run an undelete or recovery utility, but it's likely easier and more reliable to just restore from a backup.

Answer 2

Backup is likely your best fix, however if that isn't an option for whatever reason there are some techniques that can help recover deleted files from ext3/4 partitions.

For any of these methods to be effective you want to drop to single user mode and unmount the disk(s) as soon as possible. And preferably run these from a livecd or other recovery environment is also a significantly safer method to avoiding accidental data loss while trying to recover your data.

I won't post an epic on undelete processes as you should try to use the backups first, here are the links I find most helpful.

• http://www.cyberciti.biz/tips/linux-ext3-ext4-deleted-files-recovery-howto.html
• http://extundelete.sourceforge.net/

Answer 3

If the rm didn't eat too much (when it happened to me, I killed it when it was halfway through /bin...), you can start the machine in rescue mode, check what packages are affected (in rpm's case, rpm -Va tells you), and reinstall those.

Be advised that this only works on new moon, after midnight. A short rain dance beforehand might be beneficial. Or not. YMMV.

(Yes, this is Unix' brutal way of teaching unsuspecting users to consider each command carefully before pressing ENTER. Consider yourself taught.)

Answer 4

I did this recently while tired on an all-nighter. If you didn't force (-f) or recurse (-r), and are using a relatively new Linux distro, you most likely deleted the symlinks in the root directory pointing to bin, sbin, and lib. I had everything fixed in less than 10 minutes by booting an identical live version of the same distro, opening a root console, mounting the old device, and recreating the symlinks. Here is the breakdown of what I did (once in the console):

I was already logged in as root. su yourself, or sudo your commands if you are not already root.

lsblk

Gives you device mountpoints. Use this to find the device for your original root directory.

mount -t ext4 /dev/sda1 /mnt

Obviously, mount as the proper filesystem into an empty directory. Device sda1 as ext4, in my case, on /mnt. Yours will quite possibly differ depending on system setup.

ls -la /

This will give you a basic idea of how your system's symlinks are set up. Compare it to your "trashed" root:

ls -la /mnt

and you'll see the symlinks are missing. Without the symlinks most distros have, you won't get any commands, and will be unable to function, and will lock up on reboot. Restoring those symlinks will correct the problem, and allow commands again, along with a full reboot. So, now . . . create all the symlinks in /mnt that are missing, that you see in /. I've noticed that there are usually three symlinks, but there could be more or less. On ls -la /, for example, I have this symlink (plus two others):

lrwxrwxrwx   1 root root     7 Nov 21 06:47 bin -> usr/bin

so to recreate that symlink in the trashed root directory mounted at /mnt we do this:

cd /mnt

ln -s usr/bin bin

Do this for all the symlinks in /, so that listing the directory shows the same symlinks for the both the current root directory and the trashed root directory, and reboot into your old "trashed" distro.

Everything should be fine at that point, so . . .

Good luck!