If you are root, and you issue

rm -rf / 

Then how far can the command go? Can you recover data from this kind of an action? Even after the binaries are gone, would the running processes still be active? What would it take to make the same physical machine boot again? What files would you need to restore to make this happen?

I could try this on a VM and see, but I want to know the rationale behind what to expect if I do this.


This command does nothing, at least on the OS I use (Solaris) with which this security feature was first implemented:

# rm -rf /
rm of / is not allowed

On other *nix, especially the Linux family, if a recent enough Gnu rm is provided, you would need to add the --no-preserve-root option to enable the command to complete (or at least start).

How far would this command go is undefined. It depends on plenty of more or less unpredictable events. Generally, processes can run even after their binaries have been removed.

  • 5
    Didn't believe you at first, but there it is. It's hard to believe it took until 2005 (Sun/BSD) and 2006 (GNU) to stop this horrific mistake from happening. – amphetamachine Aug 27 '11 at 10:15
  • 5
    You can still use rm -rf /* to delete ANYTHING – Felix Yan Feb 8 '12 at 7:35
  • 2
    Indeed but in that case there is nothing rm can (easily) do as the file expansion is already done by the shell before rm is called. – jlliagre Feb 8 '12 at 14:50

Even with jlliagre's excellent answer, remember this is still a pretty dangerous thing to do. Always double check where you are before doing things like rm -rf. It would be catastrophic if you were to do rm -rf * while in the /usr directory, for instance.

As to the rest of your questions, what you can recover pretty much depends on your backup procedures. In most *nix systems there is no simple way to recover files and directories once they have been deleted. Unlike the old DOS days where files were often still on the disk after a delete was performed, most systems these days do things that make recovery very difficult. This is one of the reasons that data recovery services are so expensive.

If you are using a VM, I recommend doing snapshots from time to time at the very least. But nothing can beat following a good backup plan.


I just tried with Ubuntu 16 and vmware workstation and with the no-preserve-root option it erased the entire disk of my running linux system. after that was finished the whole vmware workstation app became unusably instable and even powering off or resetting the virtual machine from the application was impossible. Killing the vmx was refused only a host reboot worked after that!

  • Nice! :) This is what I was hoping to hear from someone. – Sudipta Chatterjee Sep 1 '16 at 23:29

As some people said, you can still use sudo rm -rf /* to remove anything. Without the asterisk works on the OS X too. Someone has made a footage on destroying OS X Yosemite like this, and I am sure that Linux based OS will experience much the same.

Things slowly begin getting irresponsive. I don't think that everything got deleted, as the terminal froze while the process was happening, but it was enough to freeze the whole thing and do a force restart.

Attempting to reboot causes a single-user mode like boot screen with errors.

  • 1
    If that can give some consolation, sudo rm -rf /* wouldn't delete the hidden files and directories in /. It would also fail to delete files masked by another mount point, files on read-only filesystems or pseudo-filesystems, immutable files or mount points. – Stéphane Chazelas Mar 10 '16 at 10:53
  • @StéphaneChazelas That was displayed in the footage too. There were errors with read-ony filesystem. Despite not deleting everything, it was enough to freeze and destroy boot (of system, not EFI) – John K Mar 10 '16 at 10:56

One can't simply destroy his/her system by issuing rm -rf / as root. Initially, the command will be issued under fail-safe mode, which will restrict the usage of rm on / but even with --no-preserve-root as an argument, the running system will not permit the removal of running processes from the disk; however, the rest of the programs and files will be removed, leaving an unusable system with (almost) no programs to run! Please check the screenshots tarred here, the command was issued in Arch Linux in Virtual Box: http://bit.ly/q9CsA4

  • Can you upload the pictures somewhere? Downloading a tar, untaring, and viewing all the files isn't something most people are going to do. Oh and URL shorteners aren't allowed on SE, always use the real link – TheLQ Aug 28 '11 at 1:07
  • 3
    You wrote: "the running system will not permit to remove running processes from the disk". As far as *nix is concerned, this is incorrect. This limitation exists on Windows but you can remove (unlink) files on Unix/Linux even while they are executed. – jlliagre Aug 28 '11 at 6:14
  • 2
    "...the running system will not permit to remove running processes from the disk..." This is, I'm afraid, not true - the files that cannot be deleted in your example are not really actual 'files' at all - they provide access to block devices, kernel modules, and other system internals. Performing a delete operation on them makes no sense and cannot be done even as root. – Nathan Osman Aug 29 '11 at 2:46
  • Here are the photos by Abhisek shared in online galery: min.us/mSQcqHGQA min.us/moyPvnYOw (by request of TheLQ) – Artem Pelenitsyn Sep 8 '11 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.