Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 4 down vote favorite

I ran rm -drf on my web server and accidentally removed everything inside /var/www/.

Of course, it had everything for our website in it. How can I undo this? Or is it possible to restore it to a previous version?

share|improve this question
1  
I guess you didn't have a backup or a copy in a version control system? – Mikel May 5 '11 at 3:10
1  
@Heather I'm sorry to hear that, but unless you've got backups, you're likely screwed. If you have a hosting company, ask them if they have tape backups that they could restore. – ceejayoz May 5 '11 at 3:12
8  
On the assumption that you're not qualified to do this recovery on your own, it may be in your best interest to unmount the drive immediately (to prevent new data overwriting any more of the deleted data than necessary) and send it to a data recovery service. Should you choose to attempt recovery yourself, it's in your best interest to mount the device read-only. – Frank Farmer May 5 '11 at 3:16
backups backups backups backups backups backups backups backups! You can't fairly get fired for making a mistake with rm but you can get fired for not making (and testing) daily backups of data. – RedGrittyBrick May 9 '11 at 9:20

migrated from stackoverflow.com May 5 '11 at 3:35

6 Answers

up vote 4 down vote

In some instances you can recover portions of deleted files from a linux filesystem but it is hard.

Honestly, human error is the biggest cause of IT outages, and your best solution is to be proactive in backing up regularly as well as using a version control system like mercurial.

I realize this may be pouring salt on the wound, but it's worth pointing out... The damage is done. The best help you can get now is to regain your composure, and get ready for an honest conversation with your boss. I would bet you're new to IT. While your boss may be angry, most people understand that human error happens, and it is part of learning. Just be sure you don't make yourself a target by doing this often

share|improve this answer
No backup .. it was a new site... help me! – Heather May 5 '11 at 3:16
3  
I'm afraid you're going to have to look back on this as a very painful learning experience. – Shadur May 5 '11 at 4:28
1  
It's really common sense to have backups of critical data, especially in a production environment. If you are new to IT and this job, your boss should really have had some sort of backup system in place. Unless backing up data was part of your job, I see the fact that there's no backup or recovery strategy as your boss's fault. – ultrasawblade May 5 '11 at 12:19
While @ultrasable has a point, you'll do yourself absolutely no favors if you try to tell your boss that - at best, you'll sound like you're playing the blame game to avoid responsibility. Honesty is likely going to be the best policy, even if it's likely to be painful in the short run. – Shadur May 5 '11 at 15:20
@Shadur I can't help but feel that you're being rather unhelpful here. The least you could do is point @Heather at something like testdisk to help recover the data. Now, it should likely be pointed out that honesty is the necessary best policy, even here, but let's be helpful. – jcolebrand May 9 '11 at 3:13
up vote 1 down vote

Backups of anything and everything should be standard practice. Also, for the web developers, they should be developing in some sort of version control (CVS, SVN, Git, etc.) on a different machine than the production web server, then checking it out on the server.

Unfortunately, all hope is probably lost by now. If anything like this happens in the future, and there are no backups, subversion, etc. pretty much your only option is to as quickly as possible unmount the drive. Then, you may have a chance of recovering the data before it's overwritten with anything else.

As a last-ditch, KISS effort... perhaps whoever was working on the site SCP'ed it over from their workstation and still has the files locally?

share|improve this answer
up vote 1 down vote

I would recommend using a tool like http://www.cgsecurity.org/wiki/TestDisk which has helped me in the past to find and recover deleted files, or I would recommend looking to see who uploaded the files most recently in the past.

share|improve this answer
up vote 1 down vote

There are tools. There is specialized distro for that, but i think list of programs they use should do. If you want distro it self just press download on the left panel. http://www.sysresccd.org/System-tools#recovery_tools

I must say that even recovering system files that will be damaged hard! I did formated my girlfriends HDD and then tried to restore it. It took ~12 hours and i saved ~3% of files because i left it [HDD] running. As soon as you do the mistake it need to unplug/unmount that HDD. As one of the people in here said - give the job to the professionals. They could restore much more.

To prevent such mistakes i strongly suggest to use trash-cli (sudo apt-get install trash-cli), and append alias rm='trash' line to .bashrc file in home file. After this all your files that are deleted with rm will be stored in trash bin not completely deleted.

P.S. I haven't mentioned backups and version control systems because it's common practice and everybody else mentioned it. From my point of view - just use it and listen what people say here.

share|improve this answer
Many people argue that aliasing rm to trash is counter-productive as it conditions you to rely on rm being reversible and this will hurt you one day when you are using a different machine, a different login or a different shell. – RedGrittyBrick May 9 '11 at 9:18
Good point, but i implement it to server where user/moderator don't know it. Therefore he acts as if rm is irreversible, but if something happens i may restore data. Its not for him, to think he is safe, it's for me. – JackLeo May 9 '11 at 10:13
up vote 0 down vote

Painful indeed, last time i had this kind of mistake, i plugged my hardisk with an external usb on my windows machine and i used a flash drive photo recovery software to recover my files partly.

One good advice is not to use this hard drive until you can recover your files, because writting new data will make your old stuff disappear for ever.

google flash drive recovery tool, there are lots of them that are free.

There is still hope

share|improve this answer
If you are still using that computer turn it off or you might destroy your last chances to recover it. – Ibrahim Diallo May 5 '11 at 3:17
1  
Testdisk is probably the best resource for this, and can be installed on just about every distro (presuming Ubuntu or Debian it IS in the main repos) cgsecurity.org/wiki/TestDisk – jcolebrand May 9 '11 at 3:14
up vote -1 down vote

I am so sorry to tell you that, it is going to be really difficult.
But dont get tensed. First of all please remove that hard-disk, or else it can easily destroy the data by writing something new data there, thereby removing the last possibilities of recovering it.

If you want to try recovering it by yourself, i ll attach one pdf which i made from some site(which i dont remember now). It has some steps to do that. But dont try if you strongly feel that you cant do it.

share|improve this answer
So a) you can't be arsed to login to that site and read the PDF for your answer, and b) you refer @Heather to a site that requires you to login in the first place, rather than linking to a tool that can help the user? -1 from me. – jcolebrand May 9 '11 at 3:15
oops.. i dint know that.. the user need to login to see that doc.. i am sorry if that is against the rules. Can you suggest some other method by which i can attach that pdf to this answer.. – Sen May 9 '11 at 8:39
upload it to a site that allows permissive downloading without requiring a login? IDK, does scribd do that? I'm not in the habit of linking PDFs for content, I would prefer to condense it down to the nominative steps (you have 30k of room to answer a question) and link the PDF at the end for authoritative/ownership reasons. – jcolebrand May 9 '11 at 14:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.