A bad written skript located in /etc/cron.daily erroneously executed find * -mtime +7 -exec rm -r {} \; as root user. As a result of this I can no longer login. Beside that the system seems to run fine (as far as I can judge without actually having a look). Unfortunately there is no recent backup of the system (last backup is from November). The System is running a software RAID 1. OS is Debian Squeeze. The script was executed about 3 hours ago. So far I have not touched the system.

What should I do next to reduce/not increase the damaged already caused? I am not sure if the system will still boot, probably not?

Update I removed one of the disks from the running system and mounted it in another. First the damage caused seemed more severe since the script actually deleted all files older than 7 days not 365. On the other hand it seems that the rm binary got deleted quite early in the process, so that most of the user stuff is still there.

1 Answer 1


First thing you should do is not using the harddisk at all. Do not boot, do not use the harddisk! Put it into an external case or another computer. Bootup some other Linux and try to recoover the files. I have never tried to undelete files on Linux, but you could try http://extundelete.sourceforge.net/ or google another solution. But the crucial part is (and I repeat myself) DO NOT USE THE DISK ANYMORE!

  • Alternatively, you can make a full image backup of the disk and then do whatever you want to the disk, secure in the knowledge that you can always restore from the image backup and try recovery a different way. Apr 22, 2015 at 11:34
  • This answer does not really address my problem but since it is probably because my question was not clear enough I will mark it as the accepted answer.
    – sigy
    May 8, 2015 at 18:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .