Accidently: $ sudo rm -R / 19sec HELP!!!!

Discussion in 'Mac Apps and Mac App Store' started by aussiedj, Jun 24, 2011.

  1. aussiedj macrumors regular

    Joined:
    Dec 31, 2008
    Location:
    Brisbane
    #1
    Ok... So I was as going to re-index spotlight... And...

    I typed: sudo rm -R / .Spotlight-v100
    Accidently put space^ there...

    It started doing something, but didn't output anything. I Ctrl-Z 'd it after about 10 seconds & want to check to see if it actually deleted my ****.

    How do I check if anything has been deleted?

    Console is only saying:

    disk logger: failed to open output file /.fseventsd/*numbers* (No such file or directory). mount point /.fseventsd

    Disclamer: Yes that was stupid of me, but I was going off a screenshot, and just didn't think... Clearly. :(
     
  2. maflynn Moderator

    maflynn

    Staff Member

    Joined:
    May 3, 2009
    Location:
    Boston
    #2
    Do you have a backup? I'm not trying to sound coy but at the very least you can compare your drive with the backups.

    Given that your issued a rm under sudo with the recursive mode and you let it run. It definitely started deleting stuff.

    If you have no backup, I'd run one now, to save your data and reinstall OSX as you have no idea what was lost.

    Another alternative is to run an undelete utility to see if you can recover what was lost but you need to stop using your mac until you use that.
     
  3. aussiedj thread starter macrumors regular

    Joined:
    Dec 31, 2008
    Location:
    Brisbane
    #3
    My last time machine backup was 22 days ago.
    Should there be a log for that? I still have the same terminal window open. Have not closed it since the... accident
    Know any that you can undelete only for specific times on a specific date?
     
  4. Omniver macrumors member

    Joined:
    May 6, 2011
    Location:
    Boston, MA
    #4
    Not unless you added the "-v" (verbose) switch to rm, which you didn't.

    From my unix sysadmin recollection, rm first deletes files (not directories) in the current directory alphabetically, then descends into the first directory alphabetically and does the same, recursively going down alphabetically and removing the files. When a directory is empty, it deletes the directory and hops back up a level and continues.

    So, if my recollection is correct, you might be able to look at your root and determine how far rm got by seeing what was left. Looking at my root, which is mostly directories, I'm guess it dove right into your Applications folder first. If that is still around, you might be very lucky and might be able to recover by just restoring the missing Application files from your Time Machine. If it made it to your "Library" (next directory alphabetically, remember Capitals are 'earlier' alphabetically than lowercase), then I think your problem is a lot worse.

    For reference, on my Snow Leopard, root looks like this:

    $ ls / | sort
    Applications
    Library
    Network
    System
    User Guides And Information
    Users
    Volumes
    bin
    cores
    dev
    etc
    home
    mach_kernel
    net
    private
    sbin
    tmp
    usr
    var​

    Good luck.
     
  5. Q-chan macrumors member

    Joined:
    Nov 2, 2009
    Location:
    Boston, MA, USA
    #5
    You are mostly out of luck - rescue whatever you can

    You are mostly out of luck. Running this command for such a long time has certainly damaged your system software severely. You should try to rescue whatever is possible, while the system is still running. If you are lucky and have Carbon Copy Cloner installed and have an empty disk capable to hold the used volume of your damaged disk, I would first try to clone your disk. Or you can try if tar still works and clone your disk with tar.

    However nothing of these is guaranteed, as your system lives mostly from what it still has in memory.

    And no, the terminal has no log.

    After finishing your rescue activity, you should do a clean install of MacOS. Don't waste your time with undeleters, they cannot bring your system back.

    Good Luck.

    Manfred

    PS: We did the same mistake on a DEC Ultrix system the night before a project demo - became a *very* long night.... [if this helps you to feel better]
     
  6. aussiedj thread starter macrumors regular

    Joined:
    Dec 31, 2008
    Location:
    Brisbane
    #6
    Wow, thanks!!

    Just checked, and it was missing the first 4 applications in the Applications folder, so Address Book to aMSN.

    Apeture is about 100meg smaller than it was at last TM backup. So I guess it ate into it? (I don't care about this program, just interested if that's how it works).

    Omniver you are a friggin genius / lifesaver man!!!! :D
     
  7. sashakla macrumors member

    Joined:
    Feb 8, 2010
    #7
    what if you install Mac OS from disk on top of what you have, without reformatting the drive?
    theoretically, it should repair your system files and the OS should be good to go.
    then it becomes a matter of figuring out what Applications are corrupted and what you have lost from the profile data, no?
     
  8. mobilehaathi macrumors G3

    mobilehaathi

    Joined:
    Aug 19, 2008
    Location:
    The Anthropocene
    #8
    you probably also obliterated your . files in /
     
  9. maflynn Moderator

    maflynn

    Staff Member

    Joined:
    May 3, 2009
    Location:
    Boston
    #9
    I still think the safest approach is to reinstall OSX. While you can definitely see that it was in the applications folder, you don't know if it other / folders beforehand.
     
  10. aussiedj thread starter macrumors regular

    Joined:
    Dec 31, 2008
    Location:
    Brisbane
    #10
    Ahh, yes.
    2 Directories + 1 File:

    Dirs:
    .vol
    .TemporaryItems

    Files:
    .file

    Anything going to go wrong if restored from a 22day old backup?
     
  11. mobilehaathi macrumors G3

    mobilehaathi

    Joined:
    Aug 19, 2008
    Location:
    The Anthropocene
    #11
    Don't know what those guys do. Although I'd hazard a guess that .TemporaryItems is not too critical.
     
  12. SaSaSushi macrumors 68040

    SaSaSushi

    Joined:
    Aug 8, 2007
    Location:
    Takamatsu, Japan
    #12
    There is some info here.

    /.vol This pseudo-directory is used to access files by their ID number (aka inode number) rather than by name. For example, /.vol/234881034/105486 is file #105486 on volume #234881034.
     
  13. aussiedj thread starter macrumors regular

    Joined:
    Dec 31, 2008
    Location:
    Brisbane
    #13
    So get this right. I type exit into Terminal... It say's there are paused jobs. So I type jobs... Sure enough, my rm -R command is #1 on the list. So I type exit again & close Terminal..... :mad::mad::mad:

    Then I notice my Utilities folder in my dock has changed icons... And I only have a handfull of Applications left... So i shutdown immediately!

    I hit the power button to restart.... And it boots.... All the way to OSX...

    I go to my Applications folder.... there are only about 6 Applications in there.. but applications all the same.

    ***You can see a certain amount of extreme luck up to this point, if I don't say so myself.***


    Then I remember that before I closed Terminal, I had just dont a up to date Time Machine Backup....

    ***You can see just a massive amount of unbelievable luck at this point***


    Then my external HDD goes dead...(my only backup)... My girlfriend seemed to think it was a good idea to move furniture around the power cables...

    ***At this point my heart stops/skips beats/does all kinds of *******

    But I plug it back in and it works fine.

    ***You can see the amount of luck is like dude buy a lotto ticket your win is guaranteed up to this point***
     

Share This Page