Is it possible to recover data from a VM after running “rm -rf /” on it
Just used an rm -rf / command on my VM and somehow it just destroyed my data on my physical drive.
The question is: What does rm -rf do in terms of deleting data (I mean does it work just like a delete button on any OS) and is it possible to recover data after this command has been used?
virtual-machine data-recovery
edited Feb 6 at 16:07
JakeGould
32.1k1098141
asked Feb 6 at 16:02
Ali SadykovAli Sadykov
1
add a comment |
Just used an rm -rf / command on my VM and somehow it just destroyed my data on my physical drive.
The question is: What does rm -rf do in terms of deleting data (I mean does it work just like a delete button on any OS) and is it possible to recover data after this command has been used?
virtual-machine data-recovery
edited Feb 6 at 16:07
JakeGould
32.1k1098141
asked Feb 6 at 16:02
Ali SadykovAli Sadykov
1
With some good data recovery tool you can get it back. I did this mistake while trying to work while dozing very badly
– pun
Feb 6 at 16:27
1
In general, never runrm -rf /for any reason. Some people like to prank “newbies” on forums and chat with that advice and it clearly is a horrible idea and a bad joke.
– JakeGould
Feb 6 at 17:37
Well, firstly, I’m a Mac user and I perfectly know that using the command would render my computer useless and even if I wanted to commit a technological “suicide” the SIP wouldn’t allow me (I know I can disable it, but don’t want to risk my data over some extra “features”). The main and the biggest mistake I’ve ever done in my life is my tendency to forget disabling network sharing (which is why this command is so dangerous when running). So the reason my data was destroyed was because I ran Parallels Desktop and used rm -rf / in Ubuntu while it was connected virtually to my home directory
– Ali Sadykov
Feb 7 at 18:01
add a comment |
Just used an rm -rf / command on my VM and somehow it just destroyed my data on my physical drive.
The question is: What does rm -rf do in terms of deleting data (I mean does it work just like a delete button on any OS) and is it possible to recover data after this command has been used?
virtual-machine data-recovery
edited Feb 6 at 16:07
JakeGould
32.1k1098141
asked Feb 6 at 16:02
Ali SadykovAli Sadykov
1
Just used an rm -rf / command on my VM and somehow it just destroyed my data on my physical drive.
The question is: What does rm -rf do in terms of deleting data (I mean does it work just like a delete button on any OS) and is it possible to recover data after this command has been used?
virtual-machine data-recovery
virtual-machine data-recovery
edited Feb 6 at 16:07
JakeGould
32.1k1098141
asked Feb 6 at 16:02
Ali SadykovAli Sadykov
1
edited Feb 6 at 16:07
JakeGould
32.1k1098141
asked Feb 6 at 16:02
Ali SadykovAli Sadykov
1
edited Feb 6 at 16:07
JakeGould
32.1k1098141
edited Feb 6 at 16:07
JakeGould
32.1k1098141
edited Feb 6 at 16:07
JakeGould
32.1k1098141
32.1k1098141
asked Feb 6 at 16:02
Ali SadykovAli Sadykov
1
asked Feb 6 at 16:02
Ali SadykovAli Sadykov
1
asked Feb 6 at 16:02
Ali SadykovAli Sadykov
1
1
With some good data recovery tool you can get it back. I did this mistake while trying to work while dozing very badly
– pun
Feb 6 at 16:27
1
In general, never runrm -rf /for any reason. Some people like to prank “newbies” on forums and chat with that advice and it clearly is a horrible idea and a bad joke.
– JakeGould
Feb 6 at 17:37
Well, firstly, I’m a Mac user and I perfectly know that using the command would render my computer useless and even if I wanted to commit a technological “suicide” the SIP wouldn’t allow me (I know I can disable it, but don’t want to risk my data over some extra “features”). The main and the biggest mistake I’ve ever done in my life is my tendency to forget disabling network sharing (which is why this command is so dangerous when running). So the reason my data was destroyed was because I ran Parallels Desktop and used rm -rf / in Ubuntu while it was connected virtually to my home directory
– Ali Sadykov
Feb 7 at 18:01
add a comment |
With some good data recovery tool you can get it back. I did this mistake while trying to work while dozing very badly
– pun
Feb 6 at 16:27
1
In general, never runrm -rf /for any reason. Some people like to prank “newbies” on forums and chat with that advice and it clearly is a horrible idea and a bad joke.
– JakeGould
Feb 6 at 17:37
Well, firstly, I’m a Mac user and I perfectly know that using the command would render my computer useless and even if I wanted to commit a technological “suicide” the SIP wouldn’t allow me (I know I can disable it, but don’t want to risk my data over some extra “features”). The main and the biggest mistake I’ve ever done in my life is my tendency to forget disabling network sharing (which is why this command is so dangerous when running). So the reason my data was destroyed was because I ran Parallels Desktop and used rm -rf / in Ubuntu while it was connected virtually to my home directory
– Ali Sadykov
Feb 7 at 18:01
With some good data recovery tool you can get it back. I did this mistake while trying to work while dozing very badly
– pun
Feb 6 at 16:27
With some good data recovery tool you can get it back. I did this mistake while trying to work while dozing very badly
– pun
Feb 6 at 16:27
1
1
In general, never run
rm -rf / for any reason. Some people like to prank “newbies” on forums and chat with that advice and it clearly is a horrible idea and a bad joke.– JakeGould
Feb 6 at 17:37
In general, never run
rm -rf / for any reason. Some people like to prank “newbies” on forums and chat with that advice and it clearly is a horrible idea and a bad joke.– JakeGould
Feb 6 at 17:37
Well, firstly, I’m a Mac user and I perfectly know that using the command would render my computer useless and even if I wanted to commit a technological “suicide” the SIP wouldn’t allow me (I know I can disable it, but don’t want to risk my data over some extra “features”). The main and the biggest mistake I’ve ever done in my life is my tendency to forget disabling network sharing (which is why this command is so dangerous when running). So the reason my data was destroyed was because I ran Parallels Desktop and used rm -rf / in Ubuntu while it was connected virtually to my home directory
– Ali Sadykov
Feb 7 at 18:01
Well, firstly, I’m a Mac user and I perfectly know that using the command would render my computer useless and even if I wanted to commit a technological “suicide” the SIP wouldn’t allow me (I know I can disable it, but don’t want to risk my data over some extra “features”). The main and the biggest mistake I’ve ever done in my life is my tendency to forget disabling network sharing (which is why this command is so dangerous when running). So the reason my data was destroyed was because I ran Parallels Desktop and used rm -rf / in Ubuntu while it was connected virtually to my home directory
– Ali Sadykov
Feb 7 at 18:01
add a comment |
2 Answers
2
active
oldest
votes
It's just like a regular file delete, only without the trash can / recycle bin that some OS's have. Therefore it does not overwrite any deleted files, so they might be recoverable for afterwards (as long as nothing else has overwritten them).
You can try TestDisk, it can try to list & then copy deleted (red) files from FAT, exFAT, NTFS, ext2, ext3, ext4... it has the advantage of recovering the file's original name, unlike PhotoRec.
Or you can try extundelete (as mentioned in this question from unix.SE:
extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 and ext4 file systems are the most common default file systems in Linux distributions like Mint, Mageia, or Ubuntu. extundelete uses information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!
answered Feb 6 at 16:36
Xen2050Xen2050
11.1k31636
add a comment |
Unfortunately rm recursive and force delete files permanently, what you could do it is power down the computer and try to recover files from the journal FS (if enable) before they get overwritten by some thing else.
If FS is ext4 here have a guide could help (if you FS is ext4):
http://ext4magic.sourceforge.net/howto_en.html
If it is XFS FS seems there have no solutions: http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete_capability.3F
if you have some data to recover you could also try with photorec but also here it is more about luck to recover all.
I'm sorry for you, I do not know other methods to perform a data recovery.
answered Feb 6 at 16:09
AtomiX84AtomiX84
4779
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1402738%2fis-it-possible-to-recover-data-from-a-vm-after-running-rm-rf-on-it%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
It's just like a regular file delete, only without the trash can / recycle bin that some OS's have. Therefore it does not overwrite any deleted files, so they might be recoverable for afterwards (as long as nothing else has overwritten them).
You can try TestDisk, it can try to list & then copy deleted (red) files from FAT, exFAT, NTFS, ext2, ext3, ext4... it has the advantage of recovering the file's original name, unlike PhotoRec.
Or you can try extundelete (as mentioned in this question from unix.SE:
extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 and ext4 file systems are the most common default file systems in Linux distributions like Mint, Mageia, or Ubuntu. extundelete uses information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!
answered Feb 6 at 16:36
Xen2050Xen2050
11.1k31636
add a comment |
It's just like a regular file delete, only without the trash can / recycle bin that some OS's have. Therefore it does not overwrite any deleted files, so they might be recoverable for afterwards (as long as nothing else has overwritten them).
You can try TestDisk, it can try to list & then copy deleted (red) files from FAT, exFAT, NTFS, ext2, ext3, ext4... it has the advantage of recovering the file's original name, unlike PhotoRec.
Or you can try extundelete (as mentioned in this question from unix.SE:
extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 and ext4 file systems are the most common default file systems in Linux distributions like Mint, Mageia, or Ubuntu. extundelete uses information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!
answered Feb 6 at 16:36
Xen2050Xen2050
11.1k31636
add a comment |
It's just like a regular file delete, only without the trash can / recycle bin that some OS's have. Therefore it does not overwrite any deleted files, so they might be recoverable for afterwards (as long as nothing else has overwritten them).
You can try TestDisk, it can try to list & then copy deleted (red) files from FAT, exFAT, NTFS, ext2, ext3, ext4... it has the advantage of recovering the file's original name, unlike PhotoRec.
Or you can try extundelete (as mentioned in this question from unix.SE:
extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 and ext4 file systems are the most common default file systems in Linux distributions like Mint, Mageia, or Ubuntu. extundelete uses information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!
answered Feb 6 at 16:36
Xen2050Xen2050
11.1k31636
It's just like a regular file delete, only without the trash can / recycle bin that some OS's have. Therefore it does not overwrite any deleted files, so they might be recoverable for afterwards (as long as nothing else has overwritten them).
You can try TestDisk, it can try to list & then copy deleted (red) files from FAT, exFAT, NTFS, ext2, ext3, ext4... it has the advantage of recovering the file's original name, unlike PhotoRec.
Or you can try extundelete (as mentioned in this question from unix.SE:
extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 and ext4 file systems are the most common default file systems in Linux distributions like Mint, Mageia, or Ubuntu. extundelete uses information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!
answered Feb 6 at 16:36
Xen2050Xen2050
11.1k31636
edited Feb 6 at 16:41
answered Feb 6 at 16:36
Xen2050Xen2050
11.1k31636
answered Feb 6 at 16:36
Xen2050Xen2050
11.1k31636
answered Feb 6 at 16:36
Xen2050Xen2050
11.1k31636
11.1k31636
add a comment |
add a comment |
Unfortunately rm recursive and force delete files permanently, what you could do it is power down the computer and try to recover files from the journal FS (if enable) before they get overwritten by some thing else.
If FS is ext4 here have a guide could help (if you FS is ext4):
http://ext4magic.sourceforge.net/howto_en.html
If it is XFS FS seems there have no solutions: http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete_capability.3F
if you have some data to recover you could also try with photorec but also here it is more about luck to recover all.
I'm sorry for you, I do not know other methods to perform a data recovery.
answered Feb 6 at 16:09
AtomiX84AtomiX84
4779
add a comment |
Unfortunately rm recursive and force delete files permanently, what you could do it is power down the computer and try to recover files from the journal FS (if enable) before they get overwritten by some thing else.
If FS is ext4 here have a guide could help (if you FS is ext4):
http://ext4magic.sourceforge.net/howto_en.html
If it is XFS FS seems there have no solutions: http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete_capability.3F
if you have some data to recover you could also try with photorec but also here it is more about luck to recover all.
I'm sorry for you, I do not know other methods to perform a data recovery.
answered Feb 6 at 16:09
AtomiX84AtomiX84
4779
add a comment |
Unfortunately rm recursive and force delete files permanently, what you could do it is power down the computer and try to recover files from the journal FS (if enable) before they get overwritten by some thing else.
If FS is ext4 here have a guide could help (if you FS is ext4):
http://ext4magic.sourceforge.net/howto_en.html
If it is XFS FS seems there have no solutions: http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete_capability.3F
if you have some data to recover you could also try with photorec but also here it is more about luck to recover all.
I'm sorry for you, I do not know other methods to perform a data recovery.
answered Feb 6 at 16:09
AtomiX84AtomiX84
4779
Unfortunately rm recursive and force delete files permanently, what you could do it is power down the computer and try to recover files from the journal FS (if enable) before they get overwritten by some thing else.
If FS is ext4 here have a guide could help (if you FS is ext4):
http://ext4magic.sourceforge.net/howto_en.html
If it is XFS FS seems there have no solutions: http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete_capability.3F
if you have some data to recover you could also try with photorec but also here it is more about luck to recover all.
I'm sorry for you, I do not know other methods to perform a data recovery.
answered Feb 6 at 16:09
AtomiX84AtomiX84
4779
answered Feb 6 at 16:09
AtomiX84AtomiX84
4779
answered Feb 6 at 16:09
AtomiX84AtomiX84
4779
answered Feb 6 at 16:09
AtomiX84AtomiX84
4779
4779
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1402738%2fis-it-possible-to-recover-data-from-a-vm-after-running-rm-rf-on-it%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
With some good data recovery tool you can get it back. I did this mistake while trying to work while dozing very badly
– pun
Feb 6 at 16:27
1
In general, never run
rm -rf /for any reason. Some people like to prank “newbies” on forums and chat with that advice and it clearly is a horrible idea and a bad joke.– JakeGould
Feb 6 at 17:37
Well, firstly, I’m a Mac user and I perfectly know that using the command would render my computer useless and even if I wanted to commit a technological “suicide” the SIP wouldn’t allow me (I know I can disable it, but don’t want to risk my data over some extra “features”). The main and the biggest mistake I’ve ever done in my life is my tendency to forget disabling network sharing (which is why this command is so dangerous when running). So the reason my data was destroyed was because I ran Parallels Desktop and used rm -rf / in Ubuntu while it was connected virtually to my home directory
– Ali Sadykov
Feb 7 at 18:01