Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Accidently: $ sudo rm -R / 19sec HELP!!!!

A

aussiedj

macrumors regular
Original poster
Dec 31, 2008
146
1
Brisbane
Ok... So I was as going to re-index spotlight... And...

I typed: sudo rm -R / .Spotlight-v100
Accidently put space^ there...

It started doing something, but didn't output anything. I Ctrl-Z 'd it after about 10 seconds & want to check to see if it actually deleted my ****.

How do I check if anything has been deleted?

Console is only saying:

disk logger: failed to open output file /.fseventsd/*numbers* (No such file or directory). mount point /.fseventsd

Disclamer: Yes that was stupid of me, but I was going off a screenshot, and just didn't think... Clearly. :(
 
Do you have a backup? I'm not trying to sound coy but at the very least you can compare your drive with the backups.

Given that your issued a rm under sudo with the recursive mode and you let it run. It definitely started deleting stuff.

If you have no backup, I'd run one now, to save your data and reinstall OSX as you have no idea what was lost.

Another alternative is to run an undelete utility to see if you can recover what was lost but you need to stop using your mac until you use that.
 
maflynn said:
Do you have a backup? I'm not trying to sound coy but at the very least you can compare your drive with the backups.
Click to expand...
My last time machine backup was 22 days ago.
maflynn said:
Given that your issued a rm under sudo with the recursive mode and you let it run. It definitely started deleting stuff.
Click to expand...
Should there be a log for that? I still have the same terminal window open. Have not closed it since the... accident
maflynn said:
Another alternative is to run an undelete utility to see if you can recover what was lost but you need to stop using your mac until you use that.
Click to expand...
Know any that you can undelete only for specific times on a specific date?
 
Quote:
Originally Posted by maflynn View Post
>> Given that your issued a rm under sudo with the recursive mode and you let it run. It definitely started deleting stuff.
Should there be a log for that? I still have the same terminal window open. Have not closed it since the... accident
Click to expand...

Not unless you added the "-v" (verbose) switch to rm, which you didn't.

From my unix sysadmin recollection, rm first deletes files (not directories) in the current directory alphabetically, then descends into the first directory alphabetically and does the same, recursively going down alphabetically and removing the files. When a directory is empty, it deletes the directory and hops back up a level and continues.

So, if my recollection is correct, you might be able to look at your root and determine how far rm got by seeing what was left. Looking at my root, which is mostly directories, I'm guess it dove right into your Applications folder first. If that is still around, you might be very lucky and might be able to recover by just restoring the missing Application files from your Time Machine. If it made it to your "Library" (next directory alphabetically, remember Capitals are 'earlier' alphabetically than lowercase), then I think your problem is a lot worse.

For reference, on my Snow Leopard, root looks like this:

$ ls / | sort
Applications
Library
Network
System
User Guides And Information
Users
Volumes
bin
cores
dev
etc
home
mach_kernel
net
private
sbin
tmp
usr
var​

Good luck.
 
You are mostly out of luck - rescue whatever you can

You are mostly out of luck. Running this command for such a long time has certainly damaged your system software severely. You should try to rescue whatever is possible, while the system is still running. If you are lucky and have Carbon Copy Cloner installed and have an empty disk capable to hold the used volume of your damaged disk, I would first try to clone your disk. Or you can try if tar still works and clone your disk with tar.

However nothing of these is guaranteed, as your system lives mostly from what it still has in memory.

And no, the terminal has no log.

After finishing your rescue activity, you should do a clean install of MacOS. Don't waste your time with undeleters, they cannot bring your system back.

Good Luck.

Manfred

PS: We did the same mistake on a DEC Ultrix system the night before a project demo - became a *very* long night.... [if this helps you to feel better]
 
Omniver said:
I'm guess it dove right into your Applications folder first. If that is still around, you might be very lucky and might be able to recover by just restoring the missing Application files from your Time Machine.
Click to expand...

Wow, thanks!!

Just checked, and it was missing the first 4 applications in the Applications folder, so Address Book to aMSN.

Apeture is about 100meg smaller than it was at last TM backup. So I guess it ate into it? (I don't care about this program, just interested if that's how it works).

Omniver you are a friggin genius / lifesaver man!!!! :D
 
what if you install Mac OS from disk on top of what you have, without reformatting the drive?
theoretically, it should repair your system files and the OS should be good to go.
then it becomes a matter of figuring out what Applications are corrupted and what you have lost from the profile data, no?
 
I still think the safest approach is to reinstall OSX. While you can definitely see that it was in the applications folder, you don't know if it other / folders beforehand.
 
aussiedj said:
Ahh, yes.
2 Directories + 1 File:

Dirs:
.vol
.TemporaryItems

Files:
.file

Anything going to go wrong if restored from a 22day old backup?
Click to expand...

mobilehaathi said:
Don't know what those guys do. Although I'd hazard a guess that .TemporaryItems is not too critical.
Click to expand...

There is some info here.

/.vol This pseudo-directory is used to access files by their ID number (aka inode number) rather than by name. For example, /.vol/234881034/105486 is file #105486 on volume #234881034.
 
So get this right. I type exit into Terminal... It say's there are paused jobs. So I type jobs... Sure enough, my rm -R command is #1 on the list. So I type exit again & close Terminal..... :mad::mad::mad:

Then I notice my Utilities folder in my dock has changed icons... And I only have a handfull of Applications left... So i shutdown immediately!

I hit the power button to restart.... And it boots.... All the way to OSX...

I go to my Applications folder.... there are only about 6 Applications in there.. but applications all the same.

***You can see a certain amount of extreme luck up to this point, if I don't say so myself.***

Then I remember that before I closed Terminal, I had just dont a up to date Time Machine Backup....

***You can see just a massive amount of unbelievable luck at this point***

Then my external HDD goes dead...(my only backup)... My girlfriend seemed to think it was a good idea to move furniture around the power cables...

***At this point my heart stops/skips beats/does all kinds of *******
But I plug it back in and it works fine.

***You can see the amount of luck is like dude buy a lotto ticket your win is guaranteed up to this point***
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back