I made a mistake last night, which deleted 1800GB of my File-Server unintentionally

Question

I ran this command yesterday, I thought on a test machine, but it was a File-Server connected through SSH.

sudo rm -rf /tmp/* !(lost+found)

My terminal emulator is Konsole. My system is Debian 7.

Question:

Did this command delete other files than the files in /tmp?

Your history don't shows any deleting errors. You killed many operating system processes while doing the "kill $( lsof /usr ... )". The file system sharing deamon may have been impacted. Did you tried to restart the services or reboot the filer ? — Emmanuel, Nov 13 '14 at 13:28
@somethingSomething Konsole isn't a shell, it is KDE's default terminal emulator. Try to type some characters in the terminal, like `dsgsadfsf` and hit enter. See the result. If it is `bash: dsgsadfsf: command not found`, then your shell is `bash`. — Gabor Farkas, Nov 13 '14 at 15:59
**I hope you have good backups.** If you're going to attempt recovery, stop using that system until you are able to make a byte-level copy of the drive to experiment on. Any writes to the file system in question will exacerbate the damage. — user, Nov 15 '14 at 22:09

score 43 · Accepted Answer · edited Nov 13 '14 at 18:51

43

The correct syntax in bash is the following:

rm /tmp/!(lost+found)

As @goldilocks wrote in the comments, the original command makes an expansion on the query (it deletes all the files in the /tmp folder, then goes on, and deletes all the files in the current working folder, in your case the home folder).

You can try to check if you can recover some of your data. There is a question about Linux data recovery here.

edited Nov 13 '14 at 18:51

HalosGhost

4,732
10
33
41

answered Nov 13 '14 at 13:32

Gabor Farkas

713
7
12

29

Ah, so it's essentially another case of the famous "the missing space in my command line that destroyed all my data" - just like in `rm -rf / tmp` ^^ – Martin von Wittich Nov 13 '14 at 14:11
8

I can't emphasise enough, that sysadmin paranoia is not causeless. :) Always back up your most valuable data in a place, where you can only write as root. – Gabor Farkas Nov 13 '14 at 15:00
9

I'd rather back up to a separate hard disk or server that is not even writable for root during normal circumstances. OP used `sudo`, so a normal folder only writable for root wouldn't necessarily have helped. – Martin von Wittich Nov 13 '14 at 15:09
Good point, I didn't pay enough attention to OP. A server can be costly, however a separate disk is fair enough. I have used a separate partition which was unmounted by default. Simple and dirty, but effective. – Gabor Farkas Nov 13 '14 at 15:20
Snapshot-capable filesystems look rather useful even for home environments nowadays. Anyway, best option is a good backup. – CijcoSistems Nov 14 '14 at 04:11
@GaborFarkas That won't stop you from being rooted :) – simonzack Nov 14 '14 at 12:06
1

@simonzack it can reduce the chance of accidents by mounting it up consequently, it's enough for me :) – Gabor Farkas Nov 14 '14 at 15:40

score 26 · Answer 2 · edited Dec 12 '14 at 15:37

26

The !(lost+found) in your rm command was probably the fatal mistake:

1978  rm -rf /tmp/* !(lost+found)
1979  sudo rm -rf /tmp/* !(lost+found)

I don't know exactly what bash is doing with that, but this command below prints everything in my /tmp/ and also everything my current directory (which is currently ~):

echo /tmp/* !(lost+found)

edited Dec 12 '14 at 15:37

StackzOfZtuff

297
2
9

answered Nov 13 '14 at 12:07

Martin von Wittich

13,857
6
51
74

The `!(folder)` is part of a command I once ran, which deleted all except `folder`. – somethingSomething Nov 13 '14 at 12:44
3

That sounds like something that might work with zsh; bash I don't think so. I get `!lost+found: event not found` as `!` is used to retrieve commands from the history. – wurtel Nov 13 '14 at 13:20
9

Yikes! *"I don't know exactly bash is doing with that"* -> it's performing an expansion. Guess what "everything except this" is? `cd /; echo !(lost+found)` >_ – goldilocks Nov 13 '14 at 13:21
@wurtel Try it with the parentheses. – goldilocks Nov 13 '14 at 13:22
I did: `$ echo !(xx0091)` `bash: !: event not found` – wurtel Nov 13 '14 at 13:32
13

Please keep in mind that `!(foo)` works in bash as "all except foo" only if `extglob` option is set. Moreover OP didn't specify which shell he is using, so really hard to guess what exactly `rm !(lost+found)` command has done in his case. – jimmij Nov 13 '14 at 13:48
5

Great remark, although OP stated he is using Debian 7, which has `bash` as default shell. He most likely didn't change this. Furthermore, in Debian 7, the `extglob` option is set to `true` by default (I just checked this). – Gabor Farkas Nov 13 '14 at 15:56
It's also set on fedora, so all in all, would probably be the default on most linux systems. – goldilocks Nov 13 '14 at 16:00

I made a mistake last night, which deleted 1800GB of my File-Server unintentionally

2 Answers2