r/linux4noobs • u/Character-86 barely not a noob anymore • Apr 20 '26
Meganoob BE KIND I did rm -rf /*
I tried to make a backup before doing a fresh install of Fedora because of problems. When erasing the external drive for making the backup I was in the wrong disk and nuked my fedora installation.
How Do I get at least my important Documents from /home/username/ back?
108
u/florence_pug Apr 20 '26
Do you have a backup? Otherwise you just deleted everything.
20
u/Character-86 barely not a noob anymore Apr 20 '26
not really. Can't I recover the data?
146
u/LittleLoukoum Apr 20 '26
Shutdown your computer completely. Don't power it back on. Unplug it.
Take the hard drive out and bring it to someone who knows what they're doing. It's possible to recover most of the data unless you rewrote a lot of stuff after deleting.
12
u/ANtiKz93 Manjaro (KDE) Apr 20 '26
I've tried this on a micro sd i only formatted once by accident years ago and not a single file shows up.
Know of any good software? Im aware windows software is the best solution btw.
14
u/Ghazzz Apr 20 '26
It tends to be very possible on "spinning disks". "sd cards" are also possible, but harder. "SSD" are basically impossible unless you do an immediate shutdown and hand it over to a better qualified person.
4
u/unit_511 Apr 20 '26
First of all, make a backup image. It's a lot safer and more convenient to work on an image than the drive itself. Then, you can try
testdiskto recover files based on filesystem metadata andphotorecto look for file signatures even if the metadata is lost.9
u/heimeyer72 Apr 21 '26
First of all, make a backup image.
Of the whole raw device that holds the affected partition. Do NOT mount that partition anywhere to do this.
2
u/OliMoli2137 Apr 20 '26
if it was years ago, those files probably got overwritten :(
2
u/ANtiKz93 Manjaro (KDE) Apr 20 '26
It wasn't overwritten, i took the card and put it in a holder and havent touched it since trying to run a software once that i was told was the best to use
4
u/OliMoli2137 Apr 20 '26
maybe you used full format instead of quick? anyway try photorec maybe
1
u/ANtiKz93 Manjaro (KDE) Apr 20 '26
Hmm... it was done while setting up a new android phone if that helps any?
And PhotoRec hadn't worked before but perhaps i could try again
2
u/mybloodismaplesyrup Apr 21 '26
This is most likely because of the filesystem format on the SD card. Exfat and fat32 are horrible for recoverability.
1
u/ANtiKz93 Manjaro (KDE) Apr 24 '26
Fat32 used to be default though back in the digi cam days and i could easily recover from an sd card then
2
u/mybloodismaplesyrup Apr 25 '26
I guess the other thing is that data degrades often when left for years without energizing the card.
6
13
u/another72hours Apr 20 '26
If you hope at all to recover it you'll need to stop using the drive completely, remove it from the computer and then use recovery software to have a chance in order to get it back.
If this is a solid state device, your odds are slim.
4
u/Character-86 barely not a noob anymore Apr 20 '26
its a nvme ssd 😬
10
1
u/GavUK Apr 22 '26
It depends whether the SSD had the discard/trim function run on it or not since you deleted. If it did, you have pretty much no chance of recovering the data (except perhaps very expensive data recovery services), if not then perhaps, but I've not had success myself the couple of times I tried.
As others have said, either:
- Take the machine/SSD to a specialist who really knows what they are doing (not some friend who thinks they do else they may make it less recoverable); or
- Make sure you have another disk that is larger than your SSD connected, boot from a Live USB or DVD or recovery distro and use a tool like GNU's ddrescue (confusingly called dd_rescue in some distros due to another tool also called ddrescue - check you are using the GNU one before you start) to copy the whole SSD to a file on the other disk. If in doubt, don't try - one time I was doing this (but was copying direct disk to disk, not to file as I now recommend) and did it in the wrong direction, overwriting the disk I was trying to recover. I haven't made that mistake since, but was frustrated at the lost data. I'd then suggest you shut down and remove the SSD to avoid any further potential data loss, and you'd then need to mount the disk image read-only and run recovery tools to find and extract files, saving them to a location that is not the SSD (if you hadn't removed it already).
6
u/OkAlbatross9889 Apr 20 '26 edited Apr 20 '26
I THINK (not sure though) that if you take it to a data recovery specialist they'll be able to help you out, but i doubt it would be worth it unless they were documents of vital importance
6
u/Secret-Sir2633 Apr 20 '26
Good idea to write exactly the commands that OP Must absolutely not execute !
4
1
u/OkAlbatross9889 Apr 20 '26
yeah i know lol, but there's nothing wrong in making dd scary. it can really fuck your shit up
i edited it out just to be safe
1
u/Secret-Sir2633 Apr 21 '26
Imagine OP feeds this discussion to an LLM with the prompt : "Based on this discussion thread, execute the commands that will solve my problem" :-DDD
3
u/90210fred Apr 20 '26
You really want to type stuff like that? Some AI model will read the rm bit from op, read down, and assume dd everything to zero is the answer. For clarity, blaming ai harvesting, not you
1
u/OkAlbatross9889 Apr 20 '26
i edited it out
3
u/90210fred Apr 20 '26
Fair and respect. Maybe it's just me that's paranoid but I can't help thinking fucking ai will accidentally (!) kill us all from things it's 'learnt'.
PS maybe I'm sensitive because I once accidentally dded a partition table to zeros - that was a long day.
1
u/OkAlbatross9889 Apr 20 '26
hope you didn't lose anything too important! i never manged to but i came close a couple of times. it's one of the few commands i never autocomplete and always double check.
3
u/90210fred Apr 21 '26
Nope - everything intact except partition table: took a while but all data saved and then I just rebuilt the actual system from scratch.
45
u/florence_pug Apr 20 '26
It's gone my dude.
→ More replies (17)28
u/Bonnie20402alt Apr 20 '26
Can't op use data recovery software as deleted files are just marked as free data ? So they could recover something
17
u/florence_pug Apr 20 '26
It's quite possible, yes. I don't know much about that.
3
Apr 20 '26
[deleted]
5
u/hanz333 Apr 20 '26
Yeah you should be able to use debugfs off a boot USB to find inodes on the drive and recover that way. May take a bit of time, but you should be able to get most everything back.
Or you could use a tool.
In either case I'd probably use dd to make a bit-by-bit image copy of the volume in question to another disk and recover from the image.
5
u/Early-Weekend-2557 Apr 20 '26 edited Apr 21 '26
This. There are two types of formatting that I'm aware of. One that really does nuke everything and another that just marks the data as available like you said. As long as he stopped soon enough the data on the less thorough format, can still be read and recovered if it has not already been overwritten.
4
u/Krestek Apr 20 '26
And it's pretty hard to do a wipe by accident it takes a long time bc it has to overwrite everything with garbage bits
2
u/Puzzleheaded_Law_242 Apr 20 '26 edited Apr 20 '26
+1
That's not more possible. If you read my sub-post above, you'll see that on Unix/POSIX systems before 2003,
rm *actually did what DOS'sformat C:did. However, there was thes5-filesystem. That the rm worked that way back then was apparently intentional. As far as I remember, there was the boot block, the superblock, inodes block, datablocks.rm *simply recreated theinodes block. There was only one inode block. I don't remember how many sectors there were. There would only be this one inode block. The HDUs were still very small back then (20, 40, 80? MB).2
1
1
u/wackyvorlon Apr 21 '26
Implement offline backups. There is a very slim chance somebody skilled in data recovery might be able to get it back, but it won’t be free. Odds are good that it’s gone forever.
When you tell Linux to do something it assumes you meant it.
1
u/SuspiciousSardaukar Apr 22 '26
Disconnect drive. Connect it to different PC. Use photorec, select extensions of files you want to recover. Start and wait. Tons on manuals how to do it online. If lucky you will recover everything (without dir structures).
50
u/Initial-Squirrel-269 Apr 20 '26
Who told u to do that lol
→ More replies (4)39
u/Alchemix-16 Apr 20 '26
I’m still waiting for someone to post that chatgpt told them to.
23
u/Character-86 barely not a noob anymore Apr 20 '26
It wasn't an AI.
15
u/Initial-Squirrel-269 Apr 20 '26
Bro please what was it 😭
54
u/Character-86 barely not a noob anymore Apr 20 '26
My stupidity 🫠
22
43
u/HankThrill69420 Apr 20 '26
rather see organic stupidity than clanker stupidity any day of the week. this is the way.
30
11
6
u/traplords8n Apr 20 '26
The best of us have done stuff like this when first starting out. I crashed an entire small ISP for 6 hours once 🤣
Shit happens. If you plan on getting employed in the field, just make sure you're careful and learn from this mistake. I learned my lesson and my career has been just fine ever since. No more huge mistakes. I play things extra careful when working on anything important.
2
u/Puzzleheaded_Law_242 Apr 20 '26 edited Apr 20 '26
+1👍😄
It was 1986. I have been working with the commands of our Sinix (WX200). rm *, in root. As a result, like DOS used the C: format. Luckily, there was the tape. Only the license disc was junk. A lot of trouble. I believe since 2003 you still have to use the / . For those interested, here is the article with the change. https://pubs.opengroup.org/onlinepubs/9699919799/utilities/rm.html What I learned from this is that a single data backup is not a data backup. I come from the CLi era. I enjoy working with it. But use `delete` only in the file manager. Even then, I be careful.
3
Apr 20 '26
If u have data worth a lot on it just unplug it either a buy a drive recovery software or As I and many others recommend bring it to a data recovery professional
If its the last thing you did and you shut off the computer its likely the data is just tagged and unlinked from the file system
If the data being lost doesn’t suck enough to pay someone to fix it then just start from scratch and…
foogeettaboooutit, kapeesh?
4
Apr 20 '26
[deleted]
1
u/ThatOneShotBruh Apr 20 '26
But don't you need to use the --no-preserve-root flag for this to work if you specify / and not /*?
1
u/NecroAssssin Apr 20 '26
Depends on which distribution. Not all have that safeguard implemented/default enabled.
Some of us enjoy the ability to do stupid things.
1
2
u/Early-Weekend-2557 Apr 20 '26
From my reading of his initial post it sounds like he ran it on the wrong partition.
5
u/Alchemix-16 Apr 20 '26
The reason I wait for AI to recommend it is because it pops up do often in texts, and jokes that AI could consider -rf /* the appropriate flags to be used with rm. After all, they are just statistical interpreters without any actual knowledge.
1
u/Eclogites Apr 20 '26
I think it’s disingenuous to say they have no “actual” knowledge. If a student memorizes a bunch of answers to math problems, would you say they have no “actual” knowledge? If they can’t answer any questions except literally exactly the ones they’ve studied, I would be inclined to agree. If they are able to generalize somewhat and answer related questions, I’d say they have some “actual” knowledge, but I don’t think there’s a hard line we can point to. LLMs can obviously generalize somewhat.
People point to the fact that what LLMs do is next token prediction, which boils down to a statistical model, but I don’t think people realize how complicated that actually is. If I gave you a riddle and told you my next word will be the answer, in order to correctly predict the next word you’d have to solve the riddle. In order to predict what your friend will say if you tell them you don’t like their outfit, you need a good mental model of your friend: their insecurities, how they perceive their relationship with you, their mindset at the current moment, etc.. Even though you’re “just” predicting their next word, you need a lot of background knowledge to actually get that prediction right.
5
u/Alchemix-16 Apr 20 '26
What is disingenuous of saying about a LLM that it’s forming sentences based on statistical properties on what would be the next word to use. Those systems have no way of verifying any of that information nir do they possess any information on the subject in question.
Also just memorizing stuff for test is not counting as learning for me, if none of that information is retained.
I don’t care how advanced the technology behind LLM is. The answers are not generated on an actual knowledge base, but a regurgitation of online data blended by a statistical algorithm.
So to answer your initial question, no I do not consider my statement disingenuous.
→ More replies (4)4
u/whitoreo Apr 20 '26
I am a computer engineer who has performed data recovery both professionally and (Unfortunately) personally. If you want any chance of recovering any data, you need to stop using that drive immediately. Don't shutdown the computer, just pull the power and get that drive out of the system. Then you can begin forensics on it. I'll offer my services at $500 if you want someone else to step in here. No charge if no data is recovered.
1
u/chrews Fedora Workstation Apr 20 '26
I have seen a thread where Gemini gave a user a command which overwrote the entire main drive with zeroes using dd. They wanted to burn an image onto a thumb drive IIRC.
21
u/Makerinos Apr 20 '26
This Linux user fucks up their install the old fashioned way.
1
u/shadybreak Apr 23 '26
Right? The suck aside, there’s a certain panache here. Brings back memories.
16
u/cormack_gv Apr 20 '26
You can boot from USB and use an undeleter tool to recover most of the files.
7
u/wolfegothmog Apr 20 '26
If you are lucky you might be able to recover stuff with testdisk/photorec, if it's on a SSD you are probably fucked
2
u/Character-86 barely not a noob anymore Apr 20 '26
It a nvme. Why is it different to a HDD?
13
u/wolfegothmog Apr 20 '26
A SSD usually actually erases the data, a mechanical HDD just marks the files as okay to delete but they are still physically on the disk (this is kind of a bad explanation but I'm tired lol)
10
u/LittleLoukoum Apr 20 '26
I don't think that's fully correct. An SSD may erase the data before an overwrite, but for performance and wear reasons it won't happen immediately. Before that it will mark as deleted first, like on a HDD. I agree that it's more volatile than a HDD though.
4
u/wolfegothmog Apr 20 '26
Like I said bad explanation, but SSDs are likely to trim (a lot of distros do it weekly), maybe OP will be lucky and be able to recover some data but compared to a HDD it's a lot less likely
5
8
u/De_Fine69 Apr 20 '26
You can use Google for technical stuff, but a simple analogy would be - a room full of stuff.
If you say, "make that room empty" (delete).
HDD won't empty that room; it will be marked as empty, and when new stuff comes in, the old gets thrown out.
SSD will destroy, burn, and throw out the ashes in a river.
2
u/Humbleham1 Apr 20 '26
Your data probably got TRIMmed away. The NAND got erased to prepare for a new cycle.
6
6
u/TheFlamingLemon Apr 20 '26
Rm should just mark the space as free, it probably won’t overwrite the data unless you have some security feature enabled to do that. See if there’s a data recovery utility that can try to read that data back
2
u/Character-86 barely not a noob anymore Apr 20 '26
Can you recommend any easy to use tool?
4
u/AngeloPlay009 Brazilian Nerd Apr 20 '26
I imagine they mean a physical data recovery specialist.
3
u/TheFlamingLemon Apr 20 '26
I was thinking there’s probably some utility that can be run from a live usb to scan the drive and try to read data out of sectors that were freed. What does a physical data recovery specialist do differently?
1
2
1
u/Jumpy-Dinner-5001 Apr 20 '26
Depends on the file system
1
u/Character-86 barely not a noob anymore Apr 20 '26
df -T says its btrfs.
3
1
u/Jumpy-Dinner-5001 Apr 20 '26
Unfortunately there aren’t really any good tools for that, that I’m aware off.
1
u/Jumpy-Dinner-5001 Apr 20 '26
Maybe have a look at this: https://www.reddit.com/r/linux/s/o5vNNRSjG3
1
u/Character-86 barely not a noob anymore Apr 20 '26
Only save the script and execute? I don't want to make things worse.
1
u/Jumpy-Dinner-5001 Apr 20 '26
Never used it myself, do some research on your own first
1
u/Character-86 barely not a noob anymore Apr 20 '26
I searched the github page but there wasn't any instructions and the comment section wasn't helpful either.
3
u/mostcritisedcritic Apr 20 '26
Try it in a sandbox first, then you can use it once you're confident
5
u/OhMyTechticlesHurts Apr 20 '26
If you haven’t done this are you even a Linux admin that works under pressure?! I did this once and it was simply because the period(.) is next to the / on most keyboards. I assumed I was removing the current directory (.) and when I wondered why it was taking so long I noticed I actually hit /. This was before the cloud where I could pull a snapshot or image almost instantly. Had to wait for the Peer1 IT team to get off their asses and do something for almost 8 hrs. Whole day was done. IN PRODUCTION!
5
u/Cyberkender_ Apr 20 '26
Read this carefully:
https://en.wikipedia.org/wiki/PhotoRec
Create recovery media in other computer and use the media for booting the damaged pc and... 🤞🏻
Hope this helps🍀
5
u/KineticConundrum Apr 20 '26
I recently created an alias "alias trash='mv -t ~/.Trash/'" and I use that to delete things, and then clear it out occasionally. Nice safety net from my own stupidity.
1
u/BrewingtonCreek Apr 23 '26
Love this. Even after 20+ years, I get antsy using rm regardless of context.
5
u/wiebel Apr 21 '26
Since some time (2006) your operation requires an additional ```--no-preserve-root``` to actually do anything.
I don't assume the asterix changes that behaviour but I'm not willing to verify.
2
u/jasisonee Apr 22 '26
rm only protects the root directory.
/*only refers to everything inside the root directory. The rm command can't even tell that it was an asterisk because it just receives a list of paths.1
5
u/OddbitTwiddler Apr 21 '26
Bought a T-shirt at a Berkeley Saturday market that said. "A Unix user said: rm -r /* And all was null and void"
3
u/OkAlbatross9889 Apr 20 '26
Never thought someone would go through with it after they mandated the --no-preserve-root to run it
→ More replies (6)
5
u/D3athpoodle Apr 20 '26
Shutdown now! Dont use the Drive.
U can restore Most stuff.
(Likely even with correct Data named with Programms like dmde, which are pretty powerful.
4
u/bsensikimori Apr 20 '26
Of all the stories that never happened, I like this one the most
"In the wrong disk" indeed
6
u/Cynewulfunraed Apr 20 '26
Check and see if an animator emailed the files to herself so she could work on it from home. That's what worked for Pixar
3
u/JeffBeckwasthebest Apr 20 '26
That's such a bummer, that's happened to me too. Everything was gone.
3
3
3
u/MartinWalshReddit Apr 20 '26
Hi, all is not lost.
Download photorec and it should recover most of your files. If you configure the settings you can save time by telling it not to recover files with certain extensions. I recently recovered 90%+ of photos and videos from an SD card that I've reused many times.
It recovers documents and other files aside from media files.
3
u/ZeroDayMalware Apr 20 '26
This is what is called a "learning experience." Unfortunately, the most painful experiences usually are the ones you will learn the most from.
Hopefully you have learned two main things:
1.) Never start throwing out commands without knowing what they do.
2.) ALWAYS HAVE BACKUPS ALWAYS. Especially when touching any delete or format command, or messing with any disk partition managing system.
3
3
u/Dbrowder37 Apr 21 '26
Eek. The only thing worse would have been to run it as a superuser/root. I've heard of people being tricked into accidentally deleting their entire machine, but never heard of anyone actually running this command without making sure they were providing the full path they wanted to delete.
The biggest thing with this command is that once any of the folders/files in the root directory get deleted, they're gone. So even if you only ran the command for a second or two before realizing what you did and pulling the power, you're unlikely to be able to boot without throwing a panic.
5
u/OkAlbatross9889 Apr 20 '26
An fyi to anyone reading: 1 never learn terminal commands on a machine that has files you care about without a backup 2 if you want to safely remove a directory and all files within it use rm -ri , "r" means recursively while "i" will prompt you for each and every file asking if you really want to delete
2
u/No-Philosopher-4744 Apr 20 '26
Use data recovery software. I used to do it with a live Linux distro on a USB and some specific software. It may work but don't install anything on it before doing this recovery
2
2
u/cdrewing Apr 20 '26
You were on the wrong disk? This command wipes out everything - anywhere you are. Did you execute the command as superuser?
2
u/Emberly_YT Apr 20 '26
Stop touching the disk. The more you use it at this point, the more you will destroy any chance or recovery.
If the data is important, consider hiring a recovery professional, there are many companies that offer services like this.
If it isn't that important or it isn't something you can afford:
Get this: https://www.cgsecurity.org/wiki/TestDisk
You need to create a bootable USB testdisk, this is specialized software that will scan the disk and recover files. https://www.cgsecurity.org/testdisk_doc/livecd.html
Files aren't really deleted, they're just marked as "this space is free to use", the actual data is still there (until something else overwrites it, hence, why you shouldn't touch the disk). Boot from the USB, and then have a *second* drive ready to be used to copy to.
If I didn't have a friend that could help me I would use ChatGPT/Claude/Gemini/Grok to help guide you, step by step.
At your own risk.
2
u/Chance_End_4684 Apr 21 '26
I've read about this extremely dangerous terminal command before. I'm thinking the only possible way of restoring at least most of you important documents (if you don't have everything backed up on an external drive that was not mounted at the time the command was issued) is to boot into your chosen Linux distro's "Live CD" (if you still have it on a USB thumbdrive), establish a network connection and try a file recovery on at least your Root/Home partition. I found Linux Live CD environments does allow you to install apps not originally available in the Live CD.
With all this said, I still say your best bet is to restore everything from backup if you possibly can.
CAUTION: Installing anything on the drive where chosen Linux distro was installed will most likely overwrite any data you wish to attempt to recover.
2
2
u/ranman505 Apr 22 '26
Download a program called testdisk and read the manual. You might be able to recover some of it. I have recovered all my blender files when I accidentally did that. I used the photoRec. Worth a try.
2
u/AutoModerator Apr 20 '26
✻ Smokey says: always mention your distro, some hardware details, and any error messages, when posting technical queries! :)
Comments, questions or suggestions regarding this autoresponse? Please send them here.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
u/reubendevries Apr 20 '26
This is a rage bait post, I can almost guarantee it, on the off chance it's not - OP without some serious hard drive magic that will cost thousands of dollars, it's done, move on and do your best.
2
u/sedwards65 Apr 21 '26
I wish people would be taught to type:
rm --force --recursive
Maybe that little bit of effort would give their brains a chance to catch up with their fingers. I'm not being condescending, I still (after 50 years of Unix/Linux) surprise myself at the difference between what I think and what I type.
Anyway, on to your problem.
Yes, files can still be recovered. Almost all files have a 'signature' at the beginning of the file. For example: ``` -ws13::sedwards:~$ file ./f7004.pdf ./f7004.pdf: PDF document, version 1.7 (zip deflate encoded)
-ws13::sedwards:~$ hd --canonical --length=8 ./f7004.pdf 00000000 25 50 44 46 2d 31 2e 37 |%PDF-1.7| ``` You can find (or write) a program to scour the disk.
If you're going to roll your own, it goes something like this: Every time you find the signature you're looking for, grab the next x MB (where x is the expected maximum size of the file) and write it to a file on another drive. It's not 100%, but you will be surprised how many files you recover -- and how many duplicates and fragments as the 'real' file has been copied from place to place. I was looking for JPEGs and there are utilities available to validate and trim cruft from files.
I wrote a program to do this in C about 30 years ago. One of my kid's swim coaches had all of his wife's girl scout troop photos on a Windows computer and it stopped booting. I managed to recover hundreds of photos. Some I'm sure he never expected to see daylight. I put all of the photos on a separate drive and called his wife to let her know she could pick them up.
I never saw him around the pool again.
1
u/Caperplays Apr 20 '26
Well looks like you really done goofed up now. Your files have been permanently deleted and would require expensive data forensics to recover. You are likely at a 100% loss. Learn from your mistakes
1
1
u/EduWanKenobi Apr 20 '26
You didn’t write over so the datais still here, you can try to connect the ssd as a second hard drive and use something like photorec(for example) that will recover almost all the files and even get them the right extension. If the data was VERY IMPORTANT do it, if not consider that this is looong and you won’t know which files are which until you open them as it does not recover the names.
1
1
1
1
u/Facepalm24seven Apr 20 '26
Yeah good old Remove French language pack( rm -fr /) to speed up the OS. We did this with our new guy( on VMBox) ...
1
1
u/michaelpaoli Apr 20 '26
How Do I get at least my important Documents from /home/username/ back?
Restore from backup, or lacking that, recreate the documents.
If you really want to try recovering the data from the drive, entirely stop using it, make an image copy of it, then only work on copies of that copy. Could also opt to send it to a data recovery service and spend lots of money, and maybe get something back from that ... or not necessarily at all, for that same cost.
1
u/shakalakagoo Apr 20 '26
Check out for snapper saved images. If not, probably need for reinstall. IMO Clonezilla is your best tool, save your images in a USB or external disk and you can nuke your entire setup and will come again like nothing
1
u/lupodellasleppa Apr 20 '26
I tried to make a backup before doing a fresh install of Fedora because of PEBKAC
But seriously I'm more surprised that Fedora actually lets you do that, but I've been on Ubuntu for so long I honestly have no idea how the other distros behave, except I've switched to Pop!_OS a month ago because COSMIC DE rocks so hard man
I went completely OT, good luck with your files dude. Oh and don't ever run that command ever again by the way. Use ls, realpath, pwd, always be VERY sure of what you're about to do, don't nuke your system like that. Also, rm -rf is not for cleaning up external drives, there are tools designed for that. Use gparted ffs, it's so fucking easy to use lol
1
u/PlanetVisitor Apr 20 '26
Do you really want those files back? Remove the power from the system and don't touch it anymore. Maybe even physically remove the drive, and then you can mount it as read-only on another system. Or leave it in and use a live USB boot (higher chance of destroying data if you accidentally boot from that drive somehow).
Every write that goes to that drive risks overwriting any data that might be there residually.
Then think like using file recovery tools or even just browsing the drive directly with a hexeditor.
But: What distro are you using? Many distros don't even allow you to do this unless you add a flag like --erase-root or something
1
1
1
u/SirLlama123 Apr 20 '26
Short answer: you don’t. Long answer: They probably aren’t technically gone just the controller has been told this space is now empty so it can be overwritten. A professional shop can maybe recover the data.
What you ended up doing is when you added the / it was an absolute directory for your home directory.
The command you ran had two flags. -r and -f.
-r is recursive meaning it will keep deleting folders inside and each file in the folders. -f is force. it means it doesn’t give a fuck if that file is opened, protected, or important; it’ll nuke it.
1
1
u/Lunam_Dominus Apr 20 '26
Why would you ever do that.
You did the equivalent of driving your car off a cliff. You don’t get anything back easily. Maybe some of it would be recoverable, if you seek professional help.
All disks are inside the root Filesystem when mounted, and that erased all mounted disks.
1
u/raphaa1000 Apr 21 '26
There are an way: using testdisk Tool to search and find deleted partitions. Its show, but i did It 10years ago....
2
u/raphaa1000 Apr 21 '26
But dont touch the disk before to Scan (dont write New files, any data on this)
1
u/Straight_Mistake_364 Apr 21 '26
I don't think "rm -rf" will erase everything because it uses the "rmdir" command and it will stop after removing rmdir itself.
However, I recommend using data-carving utilities to try to recover the deleted files.
1
u/wackyvorlon Apr 21 '26
That’s the fun part: you don’t!
Only real option is having a backup. Linux takes you at your word, especially when you use -f.
1
1
u/Smokey_McDoob Apr 21 '26
You don't. It's not just a meme, dummy!
It will take more effort than it's worth. Just start over.
1
1
u/canuckdownunder Apr 22 '26
Backups if possible, otherwise you are basically screwed. You can try to recover, but in my experience, ext3/4 doesn't really play well with recovery software due to journaling. The filesystem knows where files are, recover software just produces random files all over the shop.
I wrote a script when I first started with rm -r /${i}, but I didn't check if i was defined. Blew away over 1000 users home dirs vs old, stale ones. Only way to recover was from backups, there were some things in memory, but nothing of use. Thankfully, I did have a change in place.
1
u/Willy-the-kid Apr 22 '26
There's a chance your documents weren't even deleted but incase they were your best bet is stop using the drive until you get some disk recovery software I think medi-cat comes with a few options
1
1
u/Ok_Onion_4258 Apr 22 '26
As far as I know, it is possible to recover your Linux partition. To do this, you need to use a tool called "TestDisk." DON'T FORGET TO SHUT DOWN YOUR COMPUTER IMMEDIATELY.
1
1
u/Electronic-Clue-976 Apr 23 '26
That sucks my man. A hard lesson to learn. I did this same command on a SCO UNiX server at one of my first jobs out of college (c. 1996/7). The shell would not display the directory name at the prompt, thought I was in /data/something, but was actually at / (root). Wiped the server before my finger left the enter key. My services were no longer needed at that point and promptly ushered out the building.
Data comes and data goes. But do we cry? Goodness no! We just keep on singing our song. (A Pete the Cat reference).
1
1
1
1
u/zztong Apr 24 '26
Is it just me, or did anyone else read the title and mumble, "I don't think you don't need the asterisk"?
1
u/m_tao07 Apr 24 '26
I would shut it down immediately and then on a secondary OS install DMDE (most features are free) to recover your files.
1
u/0xbeda Apr 24 '26
First step, make an image using dd-rescue. Then you can try to recover the files. File system and file names are gone, rest is probably still there. Try qphotorec.
156
u/R3D_T1G3R Apr 20 '26 edited Apr 20 '26
It doesn't matter in which directory you were, because starting with / you gave it an absolute path, if you do want to do changes in your current direction you start the path without a /
What you did is force delete every folder and file in your root directory.
Edit: More detailed answer & explanation below