Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If you are root, and you issue

rm -rf / 

Then how far can the command go? Can you recover data from this kind of an action? Even after the binaries are gone, would the running processes still be active? What would it take to make the same physical machine boot again? What files would you need to restore to make this happen?

I could try this on a VM and see, but I want to know the rationale behind what to expect if I do this.

share|improve this question
3  
Duplicate of: superuser.com/questions/312769/… –  Stéphane Gimenez Aug 27 '11 at 10:09
    
@Ste True, but as long as it's not copy/pasted we generally let it go, since we have some overlap with other sites –  Michael Mrozek Aug 27 '11 at 14:55
add comment

3 Answers

up vote 15 down vote accepted

This command does nothing, at least on the OS I use (Solaris) with which this security feature was first implemented:

# rm -rf /
rm of / is not allowed

On other *nix, especially the Linux family, if a recent enough Gnu rm is provided, you would need to add the --no-preserve-root option to enable the command to complete (or at least start).

How far would this command go is undefined. It depends on plenty of more or less unpredictable events. Generally, processes can run even after their binaries have been removed.

share|improve this answer
4  
Didn't believe you at first, but there it is. It's hard to believe it took until 2005 (Sun/BSD) and 2006 (GNU) to stop this horrific mistake from happening. –  amphetamachine Aug 27 '11 at 10:15
1  
You can still use rm -rf /* to delete ANYTHING –  Felix Yan Feb 8 '12 at 7:35
    
Indeed but in that case there is nothing rm can (easily) do as the file expansion is already done by the shell before rm is called. –  jlliagre Feb 8 '12 at 14:50
add comment

Even with jlliagre's excellent answer, remember this is still a pretty dangerous thing to do. Always double check where you are before doing things like rm -rf. It would be catastrophic if you were to do rm -rf * while in the /usr directory, for instance.

As to the rest of your questions, what you can recover pretty much depends on your backup procedures. In most *nix systems there is no simple way to recover files and directories once they have been deleted. Unlike the old DOS days where files were often still on the disk after a delete was performed, most systems these days do things that make recovery very difficult. This is one of the reasons that data recovery services are so expensive.

If you are using a VM, I recommend doing snapshots from time to time at the very least. But nothing can beat following a good backup plan.

share|improve this answer
add comment

One can't simply destroy his/her system by issuing rm -rf / as root. Initially, the command will be issued under fail-safe mode, which will restrict the usage of rm on / but even with --no-preserve-root as an argument, the running system will not permit the removal of running processes from the disk; however, the rest of the programs and files will be removed, leaving an unusable system with (almost) no programs to run! Please check the screenshots tarred here, the command was issued in Arch Linux in Virtual Box: http://bit.ly/q9CsA4

share|improve this answer
    
Can you upload the pictures somewhere? Downloading a tar, untaring, and viewing all the files isn't something most people are going to do. Oh and URL shorteners aren't allowed on SE, always use the real link –  TheLQ Aug 28 '11 at 1:07
2  
You wrote: "the running system will not permit to remove running processes from the disk". As far as *nix is concerned, this is incorrect. This limitation exists on Windows but you can remove (unlink) files on Unix/Linux even while they are executed. –  jlliagre Aug 28 '11 at 6:14
2  
"...the running system will not permit to remove running processes from the disk..." This is, I'm afraid, not true - the files that cannot be deleted in your example are not really actual 'files' at all - they provide access to block devices, kernel modules, and other system internals. Performing a delete operation on them makes no sense and cannot be done even as root. –  Nathan Osman Aug 29 '11 at 2:46
    
Here are the photos by Abhisek shared in online galery: min.us/mSQcqHGQA min.us/moyPvnYOw (by request of TheLQ) –  Artem Pelenitsyn Sep 8 '11 at 6:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.