The Big Pitfall of Accidental Deletion on Linux, and Simple Recovery Tricks

Linux下的误删大坑与简单的恢复技巧 苏剑林 · 2017-07-16 · Machine Learning linux technique

Warning

The following content includes a number of high-risk actions—please don't imitate them casually. Minors should watch under parental supervision~ (^_^)

Self-destruct mode

Linux (and everything below applies equally to Mac OS) is famous for its openness and freedom, but sometimes it's a bit too open, and the author has been burned by this "too open" nature more than once (of course, mainly due to my own bad habits). So I've decided to summarize and share, purely for everyone's entertainment.

The most classic example is that the following command will achieve "suicide":

sudo rm / -rf

This will destroy your Linux system entirely. Obviously, if this were Windows, it would be the equivalent of formatting the system drive from within the operating system itself—something that's simply never allowed. more

A similarly dangerous command is mv. For example, the command below, while not as severe as rm, can still pretty much wreck your system:

sudo mv /* /root

There are quite a few other high-risk commands like this—for instance dd. On Linux or Mac OS, using dd to flash an image is very common, but you must be absolutely sure you've got the right target device, or you might regret it down to your bones. For example:

sudo dd bs=4m if=xxx.img of=/dev/rdisk0

And just like that, your system is dead~ This happened to me personally!! While flashing an image onto a Raspberry Pi, I wiped out my own MacBook's system, and it took forever to reinstall it over the network.

Accidental-kill mode

Of course, even though a command like sudo rm / -rf is dangerous, we're not stupid enough to just run it directly. So commands like that are basically just for entertainment—they don't lead to any actual dangerous consequences. The more serious consequences tend to arise by accident, and often in ways you'd never expect (especially for beginners).

For example, the following command is quite common:

sudo mv a/* b

The intent is simple: move everything inside directory a in the current path into directory b in the current path. It looks pretty safe, and shouldn't affect the system itself, right? But what if your finger slips and you type one extra space?

sudo mv a /* b

Sorry, but... well, too bad~ Your only hope is that you notice in time and hit Ctrl+C, otherwise you're in for a world of trouble. This will move all of your system files into directory b, after which almost no commands will work anymore (including mv itself). This is actually a pit I fell into not too long ago, and it cost me a lot of wasted time~ By the way, the rm command carries the exact same risk.

Recovery mode

Now that we've gotten the sad stories out of the way, let's talk about something a bit more comforting~

If you've accidentally deleted system files—especially in a catastrophic way—then I'm afraid there's nothing I can do to help. However, if you've only accidentally deleted a plain text file, such as a code script you just finished writing but hadn't backed up yet (especially one you poured your heart and soul into, long enough to make you want to die when it's gone), there's still a chance of recovering it, and the recovery process isn't too complicated.

Let's first create a file:

echo '物理宇宙学是天体物理学的分支，它是研究宇宙大尺度结构和宇宙形成及演化等基本问题的学科。宇宙学的研究对象是天体运动和它的第一起因，在人类历史的很长一段时期曾是形而上学的一部分。作为科学，宇宙学起源于哥白尼原则和牛顿力学，它们指出天体和地球上的物体遵守同样的物理原理并解释了天体的运动。现在这一分支被称为天体力学。一般认为，物理宇宙学起源于二十世纪的爱因斯坦广义相对论和对极远天体的天文观测。' > test.txt

Then delete it with rm test.txt, and next run:

sudo grep -a -B 5 -A 10 '宇宙学的研究对象是天体运动和它的第一起因' /dev/sda5 > results.txt

Explanation of the parameters:

1. grep is a text search tool based on regular expressions;
2. -a means --binary-files=text, treating binary files as text files;
3. the -B and -A options specify how many lines before and after the match to include;
4. '宇宙学的研究对象是天体运动和它的第一起因' ("Cosmology studies the motion of celestial bodies and its first cause") is some content from the original text file;
5. /dev/sda5 is the disk device, which you can check with the df command;
6. > results.txt redirects the output into the file results.txt.

This command takes quite a while to run, and might even throw an out-of-memory error. Regardless, once the command finishes running, we can search through results.txt for the content we need. If you're lucky, the deleted content will be right there in results.txt. If you'd edited test.txt multiple times, the original text fragment might appear repeatedly throughout results.txt. To pinpoint the exact piece of text, you can use a programming tool to read results.txt and then search it (because if the text fragment you searched for is too generic, results.txt could end up huge, and an ordinary text editor won't be able to handle it at all). For example, here's how I'd do it in Python.

s = open('results.txt').read()
'宇宙学的研究对象是天体运动和它的第一起因' in s #显示为True，有戏^_^
idx = s.index('宇宙学的研究对象是天体运动和它的第一起因')

#查看是否我们刚才删掉的内容
#如果不是，可以让s = s[idx+len('宇宙学的研究对象是天体运动和它的第一起因'):]，重新执行上面的操作
print s[idx-100:idx+100] #逐步调整100这个参数，直到找到我们删掉的内容为止。

Who would've thought Linux had this trick up its sleeve~ I actually accidentally deleted a script myself a few days ago, and only found this out by Googling it afterward. Indeed, technology really is a body of knowledge accumulated through blood and tears.

References

http://coolshell.cn/articles/2822.html