I ran this command yesterday, I thought on a test machine, but it was a File-Server connected through SSH.

sudo rm -rf /tmp/* !(lost+found)

My terminal emulator is Konsole. My system is Debian 7.


Did this command delete other files than the files in /tmp?

  • Could it be that /home file system is not mounted ?
    – Emmanuel
    Commented Nov 13, 2014 at 12:54
  • @Emmanuel I've confirmed that the files are lost. Commented Nov 13, 2014 at 13:01
  • 1
    Your history don't shows any deleting errors. You killed many operating system processes while doing the "kill $( lsof /usr ... )". The file system sharing deamon may have been impacted. Did you tried to restart the services or reboot the filer ?
    – Emmanuel
    Commented Nov 13, 2014 at 13:28
  • 1
    @somethingSomething Konsole isn't a shell, it is KDE's default terminal emulator. Try to type some characters in the terminal, like dsgsadfsf and hit enter. See the result. If it is bash: dsgsadfsf: command not found, then your shell is bash. Commented Nov 13, 2014 at 15:59
  • 5
    I hope you have good backups. If you're going to attempt recovery, stop using that system until you are able to make a byte-level copy of the drive to experiment on. Any writes to the file system in question will exacerbate the damage.
    – user
    Commented Nov 15, 2014 at 22:09

2 Answers 2


The correct syntax in bash is the following:

rm /tmp/!(lost+found)

As @goldilocks wrote in the comments, the original command makes an expansion on the query (it deletes all the files in the /tmp folder, then goes on, and deletes all the files in the current working folder, in your case the home folder).

You can try to check if you can recover some of your data. There is a question about Linux data recovery here.

  • 29
    Ah, so it's essentially another case of the famous "the missing space in my command line that destroyed all my data" - just like in rm -rf / tmp ^^ Commented Nov 13, 2014 at 14:11
  • 8
    I can't emphasise enough, that sysadmin paranoia is not causeless. :) Always back up your most valuable data in a place, where you can only write as root. Commented Nov 13, 2014 at 15:00
  • 9
    I'd rather back up to a separate hard disk or server that is not even writable for root during normal circumstances. OP used sudo, so a normal folder only writable for root wouldn't necessarily have helped. Commented Nov 13, 2014 at 15:09
  • Good point, I didn't pay enough attention to OP. A server can be costly, however a separate disk is fair enough. I have used a separate partition which was unmounted by default. Simple and dirty, but effective. Commented Nov 13, 2014 at 15:20
  • 1
    @simonzack it can reduce the chance of accidents by mounting it up consequently, it's enough for me :) Commented Nov 14, 2014 at 15:40

The !(lost+found) in your rm command was probably the fatal mistake:

1978  rm -rf /tmp/* !(lost+found)
1979  sudo rm -rf /tmp/* !(lost+found)

I don't know exactly what bash is doing with that, but this command below prints everything in my /tmp/ and also everything my current directory (which is currently ~):

echo /tmp/* !(lost+found)
  • The !(folder) is part of a command I once ran, which deleted all except folder. Commented Nov 13, 2014 at 12:44
  • 3
    That sounds like something that might work with zsh; bash I don't think so. I get !lost+found: event not found as ! is used to retrieve commands from the history.
    – wurtel
    Commented Nov 13, 2014 at 13:20
  • 9
    Yikes! "I don't know exactly bash is doing with that" -> it's performing an expansion. Guess what "everything except this" is? cd /; echo !(lost+found) >_<
    – goldilocks
    Commented Nov 13, 2014 at 13:21
  • 13
    Please keep in mind that !(foo) works in bash as "all except foo" only if extglob option is set. Moreover OP didn't specify which shell he is using, so really hard to guess what exactly rm !(lost+found) command has done in his case.
    – jimmij
    Commented Nov 13, 2014 at 13:48
  • 5
    Great remark, although OP stated he is using Debian 7, which has bash as default shell. He most likely didn't change this. Furthermore, in Debian 7, the extglob option is set to true by default (I just checked this). Commented Nov 13, 2014 at 15:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .