Undo an "rm -rf ~" command?

linux rm

142,036

Solution 1

In general there is no easy way back.

You could restore from your daily backup.

Solution 2

Others (such as @RiMMER, @Adam, and @James T) have mentioned that, for most filesystems, it's possible to recover most or all of your data (perhaps without filenames), because the data is not actually zeroed out, only removed from the file-table. This is not just true of Linux - the same is true of Windows and Mac.

However, no one has mentioned the most important thing - TURN OFF YOUR COMPUTER. NOW..

Many programs - including the internet browser you're using right now - will cache data to the hard-drive, and pretty much anything you do can cause your computer to resize/write to the swap file. Both of these things will write to free sectors on the hard drive, potentially overwriting your precious data.

Thus, turn off your computer, take out the hard-drive, and put it in another computer. Mount the hard-drive as read-only, and recover the files onto a separate hard-drive. When you've recovered everything you can of interest - and only then - write the files back to the original drive.

Solution 3

I believe that every linux user at one point in time must learn this painful lesson firsthand before actually learning the importance of backups, as well as paying attention to detail and being careful.

For instance, if you're deleting wierd looking files, you could first run commands on that wierd file that have no side effects and that don't make changes to your data. For instance, had you run

cd ~

before trying to delete the folder, you would have seen that it would instead change directory to your home folder, not the ~ folder. Once you go through enough troubleshooting steps to learn the true command you would need to correctly cd into the ~ folder, then you could press your up arrow key to pull the last command from history and then change cd to rm and then and only then try to delete the folder.

I suggest taking steps like this before performing any action that is permanent. It's not permanent or foolproof, but you have a much better chance of preventing those oops moments if you take this degree of care when performing actions that have side effects.

Solution 4

If you are using the ext3 filesystem, then ext3grep is your new best friend. A good tutorial (among many others) on using ext3grep can be found here.

Solution 5

You can try using testdisk to undelete individual files. This apperently only works on ext2 and NTFS (but still worth a try).

If you have ext3 or ext4, you can recover known files using photorec, which will probably end up recovering more than you want it to. Photorec recovers files without the filename information so it can be tedious to go through the files.

View more solutions

142,036

Chris

Updated on September 18, 2022

Comments

Chris 3 months
I had a folder I didn't want named '~', so from the command line I typed
```
rm -rf ~
```
and accidentally deleted my home folder (since ~ resolved to /home/username). Is there any way back or do I basically need to recreate the account from scratch?
- Tarnay Kálmán over 11 years
  
  What file system?
- LawrenceC over 11 years
  
  If you just want to restore your ability to login, login as root, mkdir /home/{your username}, and then chown {your username}:{your group} /home/{your username}.
- Blomkvist over 11 years
  
  Clearly you people have no sense of humor.
- Thomas Eding over 11 years
  
  If you get in the habit of using shred instead of rm, you should end up ok in the end.
- Henrik N over 11 years
  
  Though this doesn't directly answer your question, rm -rf "~" with quotes will look for that literal name instead of expanding it. But I would be scared to use that anyway – I would use something like ls or cd first to verify I get the right dir, or delete the folder from a GUI file manager. Perhaps first rename the dir (mv "~" tilde), verify and then remove.
- Fred Nurk over 11 years
  
  For the future, don't use rm interactively at the command line. Use a utility like trash and you 1) can't make the same mistake again and 2) can't get used to a poor shell alias of rm that will cause you trouble.
- HikeMike over 11 years
  
  @Fred rm -ir ~ will print examine files in directory /Users/danielbeck. It's safe enough for use like this.
- Fred Nurk over 11 years
  
  @DanielBeck: If you have the discipline to always type the option, that works fine. In my experience, users are more likely to drop the option and go back to using rm directly.
- Fred Nurk over 11 years
  
  @HenrikN: ./~ instead of "~" does the same, but also works with other common problematic filenames, like those that start with dashes and look like options.
- Arda Xi over 11 years
  
  @FredNurk Just not using -f is already an improvement.
- HikeMike over 11 years
  
  Blomkvist As I reported and commented on your answer, I assume your comment was directed at me. Just post your non-answers (i.e. comments) as actual comments next time and nobody will care. They'll probably even help you get the Pundit badge. I liked the story and would have upvoted a comment.
- isomorphismes over 10 years
  
  Like @Henrik N's comment this is not a solution either. But I always use gvfs-trash (Ubuntu) even if I'm at the command line, instead of rm. It can delete directories or files, and unlike rm there is a recovery option. I made an alias del=gvfs-trash in my .bash_aliases and also aliased mv to mv -i to avoid the other kind of irreparable error.
- sjas almost 10 years
  
  Just be happy it wasn't rm -rf / or rm -rf .... ;)
- unforgettableidSupportsMonica about 7 years
  
  I'm just curious: who created the folder named '~' which you found on your computer?
- Daniel F almost 7 years
  
  Where do I get my '"sudo rm -rf ~"-without-a-backup'-badge? I want to claim it right now.
- Craig Tullis about 6 years
  
  Don't name folders "~"? ;-)
Benjamin Bannier over 11 years

Your remark on backups is cruel and 100% to the point.
BlueRaja - Danny Pflughoeft over 11 years

Even the process of shutting down can write to the hard-drive. I'm hesitant to recommend immediately unplugging your computer, because that can definitely make things much worse, but... well, depending on how important the data is, you might want to consider it.
jmort253 over 11 years

Only problem with this is you may become a little fast and loose with the rm command and forget that you don't have the handy undelete functionality on your company Linux server... oops...
Thorbjørn Ravn Andersen over 11 years

OS X sets the bar for how backups should work (especially with Time Capsule). See maketecheasier.com/… for suggestions how to get somewhat the same thing with Ubuntu.
Matthew Scharley over 11 years

Depending on the drive/OS/mount point it may be possible to immediately unmount and/or remount readonly live without turning the pc off, then shutting down etc.
Fake Name over 11 years

@Thorbjørn Ravn Andersen - It does, except when Time Machine has a nervous breakdown. I've had time machine have a freak-out on me twice in six months.
Henrik N over 11 years

Offsite backup is great and can be pretty affordable. I use Backblaze (Mac/Windows) at $5/computer/month. Many people seem to like Crashplan (Mac/Windows/Linux).
Thorbjørn Ravn Andersen over 11 years

@Fake Name, really? Has worked well for me.
Fred Nurk over 11 years

If you do this, you will one day not have this alias in place – maybe you're sitting at another computer or you have ssh'd into somewhere – and you will use rm being used to the safety net. You will do something you regret.
Fred Nurk over 11 years

killall rm instead of turning off.
MSpeed over 11 years

Depending on how big your home directory was and how big your hard drive is, the chances of over-writing the free sectors which contains your data is pretty slim.
Arda Xi over 11 years

@FredNurk Exactly. Best bet is to just add the -i yourself, or just not use the -f option.
Satanicpuppy over 11 years

You can recover text files using this method without a lot of difficulty (as long as you have a rough idea of whats in them), but binary files are so difficult as to be basically impossible.
Luc M over 11 years

daily what ????
DMA57361 over 11 years

-1 This has the same problem as over down-voted answers (so I'll steal someone else's comment): one day not have this script in place – maybe you're sitting at another computer or you have ssh'd into somewhere – and you will use rm being used to the safety net and you will do something you regret.
sleske almost 11 years

@Satanicpuppy: That depends on circumstances (particularly on the FS in use). I once accidentally deleted an 800MB video file, and was able to undelete it without any data loss - however that was on a separate partition without any regular write activity. So it really depends (and for the record, the partition used Ext3).
sleske almost 11 years

+1 for mentioning that on most journaled FSs, even a readonly mount may write data as part of journal acitivities.
LawrenceC over 10 years

Look before you leap, and ls before you rm.
Morgan Wilde over 9 years

@LucM well, if you had a Mac - time machine, and all you need to know is to open it up when you need something restored.
Martin Vseticka over 7 years

Put your +1 if you happen not to have your daily backup.
John Militer almost 6 years

@Corey Although I agree that this could cause a bad habbit, +1 because this answer has been too heavily downvoted
markroxor over 3 years

@MartinVseticka nice try :)