-2

I was trying to remove this trojan that copied itself across my system and after successfully seeing all instances of the trojan using find / -name trojan I then did find / -delete -name trojan and immediately starting seeing "Operation not permitted" on files that were not related to the trojan so I killed the command with Ctrl-C but now I am having some problems.

From what I can tell, my important files are still there, and I haven't been able to figure out what it deleted, however I cannot open a new terminal window, I get a message saying '/bin/bash' No such file or directory, however if I open the file explorer it shows that bash is in /bin as well as all the other bin files. Additionally I still have a terminal open, but the only commands that work are the builtin ones (cd, echo, etc) If I try to do even ls, I get that /bin/ls cannot be found. Similarly if I type any command that is not builtin I get the same message but it tells me exactly where the file is (I can see it in explorer) bu then says no such file or directory.

How can I recover from this? Is there a way to find out what my system is missing?

  • 5
    You deleted essential files, there is no incantation that will bring them back. Backup what you need if it is still there and reinstall the system. – Rui F Ribeiro Jan 24 '18 at 0:03
  • @RuiFRibeiro you don't think I could boot from a live usb and install essential files, any command that was running is still running so I know commands work, they just aren't linked properly now. Anything that I have thought to check is still there. – fjames003 Jan 24 '18 at 0:13
  • 2
    You're not supposed to put -delete in front of -name. – Chai T. Rex Jan 24 '18 at 0:14
  • 1
    @fjames003 too much work trying to recover the system, either restore it from backups or reinstall. No use crying over spilt milk. – Rui F Ribeiro Jan 24 '18 at 0:29
  • 3
    yes. find does things in the order they appear on the command line. by default, predicates are ANDed (-a) with previous predicates, but you can use -o to override that and OR them. You can also use parentheses (escaped in sh \( ... \)) to control order of evaluation. find's command line is a fairly complex language and takes some getting used to. e.g. find / -delete -name trojan means "find everything under /, then delete all matches, then search for files with name trojan". find / -name trojan -delete means "find everything under / with name trojan and delete them". – cas Jan 24 '18 at 1:14
2
find / -delete -name trojan

attempted to delete all files on the root filesystem. The command you meant to use is

find / -name trojan -delete

Sorry to be the bearer of bad news but your system is FUBAR. You should boot up from a live CD, copy on an external drive any important personal file might have been left on the system, then do a fresh reinstall.

0

I wrote a howto about how to recover from mass deleting files on a linux system (when it was still just ext3). My method used information from the journal however, so in general it could only recover files that were recently (eg in the last week) accessed (which causes the update of access time and therefore a copy of the inode table to the journal), or whose inodes were in the same inode block as those of files recently accessed.

You can still find my howto here: http://carlowood.github.io/howto/undelete_ext3.html

In the meantime there have been written many tutorials and even youtube vids on how to use ext3grep (use Google to search for them), as well as there is spin off project for ext3 and ext4 that might be easier to use (I never looked at it I have to admit); which you can find here: http://extundelete.sourceforge.net/

In all cases - after a mass deletion - you want to stop writing to your harddisk as soon as possible and preferably umount it - even just a shutdown Although a shutdown and thus a clean umount of your harddisk risks overwriting data because it will write more to your disk, I think it is worth it because a cleanly umounted disk is easier to recover using this method. Immediately remounting the disk readonly followed by a shutdown might be the best option. After that you have to work from a live DVD to make a copy of your disks image (using dd), or put the harddisk in another PC. Don't mount it again until you made a backup or recovered the deleted files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.