HELP! Undo rm -r command

FluoroNeuro · May 12, 2015

Hey everyone,

I am desperately seeking help. I am at work and just recently got a new iMac because my last one was acting up a lot. I work as a graphic designer and resolved to keep all my files on an external harddrive going forward, in order not to bog down my computer. It's only been a few weeks now since the switch.

Yesterday, I exported a .jpg from Illustrator to present at a meeting and every time I tried to attach it to an e-mail, or even just highlight it in Finder, it would crash my computer. So today I decided I wanted it gone. Since I can't highlight it to delete it to the Trashcan, I needed to get creative.

I asked an IT friend if he knew at all, and he suggested I type this command into Terminal: rm -r /Volumes/ DSatterfield$/promos/lir/Canadian Social Security iHTML/subheads.jpg

Subheads.jpg is the file in question. I'm not experienced with Terminal and had no idea how powerful it really is. Suffice to say, it deleted my entire external harddrive. Didn't even ask me to confirm or anything, it's just gone. I didn't know at the time (which I do now, thanks to panic research) that the -r is recursive and will delete everything along that path.

So where I'm at now is I'm missing 2.5 years of work. Everything I've done since my first day on the job is gone. All the assets my company relies on for promotional material is poofed. Obviously, we should have backed up. We don't have a protocol for that here, and I'm not tech-savvy enough to have set up a system for it. Hindsight is 20/20 I guess.

Here's what I need:

Is there a way to recover this data AT ALL? From what I can find online, it seems I have a SLIM chance if I send it off to data recovery specialists. My job, and thus my life, are now in jeopardy because of an innocent mistake and I am frantic to find an answer. I have passed the external harddrive in question off to my IT department, but they don't seem very optimistic.

There MUST be a way to get that stuff back. I need some hope here I have 2.5 years of work riding on this and I am desperate to find a solution. I can throw money at it if it will help.

Please, anyone.

techguy9 · May 12, 2015

You can use a data recovery tool. I don't know of any, but a quick search should turn up a few.

Tumbleweed666 · May 12, 2015

Send it off to a data recovery specialist. The data will be there. I wouldn't leave it in the hands of your iT dept if they think it can't be recovered and didn't make sure you took backups. (Fwiw you could probably get it back yourself but is it worth the risk you might make things worse?)

I'm astounded by the casual attitude you and your company took to backups. What about fire, flood, theft or plain old mechanical breakdown? Did you think these devices would last forever? Never went wrong ?

Fwiw the being tech savvy you needed was " plug an external disk in, the mac would ask you if you'd like to use it for backups (time machine)" and that's it.

So when you get your data back, buy another disk for time machine.

And FwIW your plan of "moving all your data off the mac not to bog it down" was pointless, you likely made it slower by making all access via a slower USB connection than the internal interface.

FluoroNeuro · May 12, 2015

Tumbleweed666 said:
Send it off to a data recovery specialist. The data will be there. I wouldn't leave it in the hands of your iT dept if they think it can't be recovered and didn't make sure you took backups. (Fwiw you could probably get it back yourself but is it worth the risk you might make things worse?)

I'm astounded by the casual attitude you and your company took to backups. What about fire, flood, theft or plain old mechanical breakdown? Did you think these devices would last forever? Never went wrong ?

Fwiw the being tech savvy you needed was " plug an external disk in, the mac would ask you if you'd like to use it for backups (time machine)" and that's it.

So when you get your data back, buy another disk for time machine.

And FwIW your plan of "moving all your data off the mac not to bog it down" was pointless, you likely made it slower by making all access via a slower USB connection than the internal interface.

What makes you so sure it will be there? I really hope you're right, but what I've heard online so far, it seems like a slim chance. How could I get it back myself? I might make it worse, but I'm not sure IT has a full grasp on it either and now my drive is in their hands and getting it back will be a fight. For now, I can only trust them.

As far as backing up no I did not think it would last forever. I have never had this issue before though. I have external hard drives from 8 years ago that are fully functional. This is just an entry-level job and not where I expect to be in 12-24 months so, I didn't expect anything to happen in the interim. Obviously, I'm stupid. Obviously, I should have backed up. But that doesn't help me now. Lesson learned.

I will certainly back up if I get my data back, and I will definitely back up from now on. Harsh way to learn that lesson, but I guess there it is.

As far as my Mac being slower now, it's been much faster. Maybe it's slower to access it from the external, but it has seemed to work so far, but maybe it's because it's just a new computer.

I don't claim to have the answers or be a perfect computer user, but I am giving it my honest best and this was an honest mistake because I trusted someone close to me. Not really sure what else I could have done other than to be cautious of what he told me. But how would I know to be cautious using Terminal? I've used it before for simple things and it's never been an issue. I didn't even believe you could permanently delete something from a computer until now. I'm honestly blown away that you can simply enter one line of code and wreck an entire machine. Suddenly my computer feels like a glass house.

2984839 · May 12, 2015

FluoroNeuro said:
What makes you so sure it will be there? I really hope you're right, but what I've heard online so far, it seems like a slim chance. How could I get it back myself? I might make it worse, but I'm not sure IT has a full grasp on it either and now my drive is in their hands and getting it back will be a fight. For now, I can only trust them.

As far as backing up no I did not think it would last forever. I have never had this issue before though. I have external hard drives from 8 years ago that are fully functional. This is just an entry-level job and not where I expect to be in 12-24 months so, I didn't expect anything to happen in the interim. Obviously, I'm stupid. Obviously, I should have backed up. But that doesn't help me now. Lesson learned.

I will certainly back up if I get my data back, and I will definitely back up from now on. Harsh way to learn that lesson, but I guess there it is.

As far as my Mac being slower now, it's been much faster. Maybe it's slower to access it from the external, but it has seemed to work so far, but maybe it's because it's just a new computer.

I don't claim to have the answers or be a perfect computer user, but I am giving it my honest best and this was an honest mistake because I trusted someone close to me. Not really sure what else I could have done other than to be cautious of what he told me. But how would I know to be cautious using Terminal? I've used it before for simple things and it's never been an issue. I didn't even believe you could permanently delete something from a computer until now. I'm honestly blown away that you can simply enter one line of code and wreck an entire machine. Suddenly my computer feels like a glass house.

The plain rm command just removes the reference to the data and marks those blocks as free space. The data is still there on disk, but the filesystem will act as if it is not. This means that it is possible to recover the actual data, provided you don't add anything new to that disk, since that would overwrite those blocks with new data.

FluoroNeuro · May 12, 2015

556fmjoe said:
The plain rm command just removes the reference to the data and marks those blocks as free space. The data is still there on disk, but the filesystem will act as if it is not. This means that it is possible to recover the actual data, provided you don't add anything new to that disk, since that would overwrite those blocks with new data.

Thank you! This is really reassuring. I also just talked directly with a data recovery specialist with a decent quote and they feel confident they can recover it. Crappy way to empty to my pockets, but it could be so much worse.

Thanks for your reply. The relief is worth a lot to me.

ardchoille50 · May 12, 2015

FluoroNeuro said:
What makes you so sure it will be there? I really hope you're right, but what I've heard online so far, it seems like a slim chance. How could I get it back myself? I might make it worse, but I'm not sure IT has a full grasp on it either and now my drive is in their hands and getting it back will be a fight. For now, I can only trust them.

As far as backing up no I did not think it would last forever. I have never had this issue before though. I have external hard drives from 8 years ago that are fully functional. This is just an entry-level job and not where I expect to be in 12-24 months so, I didn't expect anything to happen in the interim. Obviously, I'm stupid. Obviously, I should have backed up. But that doesn't help me now. Lesson learned.

I will certainly back up if I get my data back, and I will definitely back up from now on. Harsh way to learn that lesson, but I guess there it is.

As far as my Mac being slower now, it's been much faster. Maybe it's slower to access it from the external, but it has seemed to work so far, but maybe it's because it's just a new computer.

I don't claim to have the answers or be a perfect computer user, but I am giving it my honest best and this was an honest mistake because I trusted someone close to me. Not really sure what else I could have done other than to be cautious of what he told me. But how would I know to be cautious using Terminal? I've used it before for simple things and it's never been an issue. I didn't even believe you could permanently delete something from a computer until now. I'm honestly blown away that you can simply enter one line of code and wreck an entire machine. Suddenly my computer feels like a glass house.

The data will remain in place until that portion of the disk is overwritten, and even then it may be possible for forensics tools to recover it. However, the pointers to the data were removed when you performed the rm command. If you're planning to take the disk in for data recovery, I would recommend that you power down the machine and do not use that disk again until after data recovery has had a chance to do their magic.

The only thing you can do yourself right now is to remember that the command line is very powerful and to research things before you run any commands, it pays to learn more about the various commands and what they do.

leman · May 12, 2015

If you haven't done ANYTHING with that drive after you have deleted the files that is, you didn't write any new data to it then there is a good chance that a data recovery professional will be able to restore it. Send it in to a reputable specialist immediately. And prepare to pay a lot of money for it.

Fishrrman · May 13, 2015

[[ I'm not experienced with Terminal and had no idea how powerful it really is. Suffice to say, it deleted my entire external harddrive. Didn't even ask me to confirm or anything, it's just gone. I didn't know at the time (which I do now, thanks to panic research) that the -r is recursive and will delete everything along that path. ]]

MacConfucius says:
"Those who flirt with Terminal while knowing little of it, will end up with BIG results!"

I trust you have learned an important lesson.
Actually, MORE THAN one lesson.

The most important lesson is -- HAVE A BACKUP.
Go forward from this day and learn, a sadder but wiser man.

It may be possible to recover the drive's data.

What you need to do now:
1. STOP USING the affected drive. DISCONNECT it RIGHT NOW.
2. You will need "data recovery" software. A number of options, including "DataRescue", "Stellar Phoenix Data Recovery", "Disk Drill", and others. I suggest you download DataRescue4 (free download in demo mode).
3. You will need ANOTHER drive to serve as a "scratch drive" to receive recovered data. Order up one right away.

How data recovery software works.
a. You download the software for free
b. You "aim it" at the problem drive
c. The dr software scans the drive, and will present you with a list of recoverable files.
d. HOWEVER, at this point, you can only recover ONE file.
e. The point of this is, the app gives you the chance to ascertain whether or not it will work for you BEFORE you pay the registration.
f. If it looks like the app can recover a good bit of your data, NOW you pay the registration fee and get a code.
g. You enter the code, and the app "goes to work" on the problem drive, scavenges and reconstructs the data, and saves it to a "scratch drive" (that's why you need ANOTHER external drive).
h. IMPORTANT -- you are probably going to lose most or all previous file names and folder hierarchies. Don't complain, this is "par for the course" with data recovery. The compensation is that you get the data itself back.

Taz Mangus · May 13, 2015

FluoroNeuro said:
Thank you! This is really reassuring. I also just talked directly with a data recovery specialist with a decent quote and they feel confident they can recover it. Crappy way to empty to my pockets, but it could be so much worse.

Thanks for your reply. The relief is worth a lot to me.

Before you spend the money to have someone do the data recovery take a look at the DiskDrill tool. I have used it to recover deleted data and it works very well.

Tumbleweed666 · May 14, 2015

My worry about having the OP do this is, it will only take one false step to turn this from a problem to a catastrophe.

I'm sure most regulars here could manage it no problem,I've recovered data in similar circumstances on friends computers when they've asked for help, but I work in iT and I've got years of previous mistakes and messes that I've learned from (some self inflicted I admit) and I know what to do because I've done it before.

I think the OP should focus on what is absolutely the main priority,restoring the data. That fact he might spend an extra $500 is really of little consequence when you consider the consequences if not getting this data back. I don't want to see him try and save a few hundred and lose it all when as well know here, it's not lost yet, it's just inaccessible.

2984839 · May 14, 2015

Tumbleweed666 said:
My worry about having the OP do this is, it will only take one false step to turn this from a problem to a catastrophe.

I'm sure most regulars here could manage it no problem,I've recovered data in similar circumstances on friends computers when they've asked for help, but I work in iT and I've got years of previous mistakes and messes that I've learned from (some self inflicted I admit) and I know what to do because I've done it before.

I think the OP should focus on what is absolutely the main priority,restoring the data. That fact he might spend an extra $500 is really of little consequence when you consider the consequences if not getting this data back. I don't want to see him try and save a few hundred and lose it all when as well know here, it's not lost yet, it's just inaccessible.

I would also advise just spending the money for something this critical. I would also get it back from IT immediately, lest they hand it back saying "We couldn't get any data off it, so we wiped it clean and reformatted it for you."

glenthompson · May 14, 2015

Going forward you should follow the 3-2-1 rule for backups as a minimum. That means 3 copies of your data, in 2 different formats, with 1 copy off-site. Two different formats means one copy in Time Machine format and the other as a clone or some other backup tool. Personally, I use 3 formats: TM, CCC clone, and CrashPlan. I usually have 2 off-site copies. This is all for personal data, nothing business related.

Whoever told you to use the rm command with a -r option is an idiot. Knowing that you only wanted to delete one file there is absolutely no reason to use -r and many reasons not to as you found out.

keysofanxiety · May 15, 2015

glenthompson said:
Whoever told you to use the rm command with a -r option is an idiot. Knowing that you only wanted to delete one file there is absolutely no reason to use -r and many reasons not to as you found out.

This. People who know a little about computers but think they know a lot are much more dangerous than technophobes, in my experience. Whoever told the OP to use the rm -r command deserves a fat backhand to the face.

FluoroNeuro · May 15, 2015

Well, I've gotta say, I really appreciate everyone's advice and responses. It means a lot that there are people out there willing to help in a time where things feel so hopeless.

As for the outcome the IT department here was able to recover what I believe to be everything. The downside is, maybe 5-10% of the files became corrupted and they are not sorted and completely renamed to gibberish. However, I'll take it!

Now the process of sorting through and renaming 79,000 files can begin. I've got a lot of fun times ahead of me. But all in all, a quite valuable lesson learned, and a complete disaster avoided. I'm still going to be paying the price for months to come as people ask me for work I cannot locate, but that's another matter entirely. For now, I can at least search and find most of my core template files and important pieces. Reassembling projects will come as it comes I guess.

As for my friend who told me the command, I cannot fault him for trying to be a helpful friend. I appreciate that he wanted to help me, but I will certainly be cautious of the advice in the future. Lesson learned to look up every Terminal command before using it. (if I ever touch that thing again)

Thank you so much to everyone who offered me some words and advice. It is much appreciated.

2984839 · May 15, 2015

FluoroNeuro said:
Well, I've gotta say, I really appreciate everyone's advice and responses. It means a lot that there are people out there willing to help in a time where things feel so hopeless.

As for the outcome… the IT department here was able to recover what I believe to be everything. The downside is, maybe 5-10% of the files became corrupted and they are not sorted and completely renamed to gibberish. However, I'll take it!

Now the process of sorting through and renaming 79,000 files can begin. I've got a lot of fun times ahead of me. But all in all, a quite valuable lesson learned, and a complete disaster avoided. I'm still going to be paying the price for months to come as people ask me for work I cannot locate, but that's another matter entirely. For now, I can at least search and find most of my core template files and important pieces. Reassembling projects will come as it comes I guess.

As for my friend who told me the command, I cannot fault him for trying to be a helpful friend. I appreciate that he wanted to help me, but I will certainly be cautious of the advice in the future. Lesson learned to look up every Terminal command before using it. (if I ever touch that thing again…)

Thank you so much to everyone who offered me some words and advice. It is much appreciated.

Glad you got most of it back. If you ever want to look up a command before you run it, type "man [command]" in the terminal (without quotes) to get the manual page for it, if there is one. In this case, you'd run "man rm" and you'll see a list of options and what they do.

FluoroNeuro · May 15, 2015

556fmjoe said:
Glad you got most of it back. If you ever want to look up a command before you run it, type "man [command]" in the terminal (without quotes) to get the manual page for it, if there is one. In this case, you'd run "man rm" and you'll see a list of options and what they do.

That's very helpful, thank you!

Taz Mangus · May 15, 2015

FluoroNeuro said:
Well, I've gotta say, I really appreciate everyone's advice and responses. It means a lot that there are people out there willing to help in a time where things feel so hopeless.

As for the outcome the IT department here was able to recover what I believe to be everything. The downside is, maybe 5-10% of the files became corrupted and they are not sorted and completely renamed to gibberish. However, I'll take it!

Now the process of sorting through and renaming 79,000 files can begin. I've got a lot of fun times ahead of me. But all in all, a quite valuable lesson learned, and a complete disaster avoided. I'm still going to be paying the price for months to come as people ask me for work I cannot locate, but that's another matter entirely. For now, I can at least search and find most of my core template files and important pieces. Reassembling projects will come as it comes I guess.

As for my friend who told me the command, I cannot fault him for trying to be a helpful friend. I appreciate that he wanted to help me, but I will certainly be cautious of the advice in the future. Lesson learned to look up every Terminal command before using it. (if I ever touch that thing again)

Thank you so much to everyone who offered me some words and advice. It is much appreciated.

Going forward it is probably a good time for you to start backing up your data. I would suggest doing 2 backups and keep one of the backups offsite. Time machine can easily handle multiple backup hard drives. Backup drives can fail so having a secondary backup is a added benefit. I learned that the hardway when my backup hard drive had a hardware failure and died.

Beachguy · May 20, 2015

FluoroNeuro,

You've already received great advice here, so my only contribution is to tell you not to feel bad about it- we all have done this. Heck- I have TWO drives I have to reconstruct because I hosed them accidentally- and I've been in IT over 30 years. Accidents happen. You'll be fine.

FluoroNeuro · May 22, 2015

Thanks to everyone who took the time to comment here. It means a lot to me to know that somebody out there cares. I'm so lucky that I even have more than one person who cares! You guys rock!

Beachguy said:
FluoroNeuro,

You've already received great advice here, so my only contribution is to tell you not to feel bad about it- we all have done this. Heck- I have TWO drives I have to reconstruct because I hosed them accidentally- and I've been in IT over 30 years. Accidents happen. You'll be fine.

Thanks for the kind words. It is good to know I am not alone. Things have been difficult transitioning forward, but all is not lost. It is 1000% better than if it was all gone forever, so I am very grateful to all who offered advice, words of wisdom and helped me to recover my data.

I would say this thread was successful and I am happy to report that my first experience here at MacRumors has been a very positive one.

Cheers!

HELP! Undo rm -r command

macrumors newbie

macrumors 6502

macrumors 68000

macrumors newbie

Cancelled

macrumors newbie

macrumors 68020

macrumors Core

macrumors Penryn

macrumors 604

macrumors 68000

Cancelled

macrumors demi-god

macrumors G3

macrumors newbie

Cancelled

macrumors newbie

macrumors 604

macrumors 65816

macrumors newbie

Our Staff