i just did a rm -rf /*r as root!!!

[Ed Wilts, RHCE]

Smith, Albert wrote:
> ***** THE FOLLOWING WOULD WORK IN THEORY I HAVE NOT TESTED THIS ****
> 
> Boot from the install CD and go into Recovery mode.
> 
> In recovery mode it will attempt to search for an existing install. If
> it see's it you will see it as /mnt/sysimage when you do a df.
> 
> Then try the following:
> 
> mkdir /mnt/sysimage/usr
> mkdir /mnt/sysimage/var
> cp -pR /usr/* /mnt/sysimage/usr/
> 
> Then reboot and it should get you up to some point. At that point I
> would use RPM to rebuild the rpm database then update your packages as
> some will most likely have to be reinstalled.

I think this will get you most of the way there - probably enough to 
boot if you didn't trash /etc.  Unfortunately you've also trashed /var 
which contained your rpm database (and other important stuff - mysql 
databases are there by default if you run mysql, mail spools, crontab 
entries, /var/www, etc.).

If you have backups, then the steps enough will get you enough to boot. 
    At that point, recover your backups on top of your running system - 
you've trashed all of /usr and /var so restore those first. It's 
important that you get the most current copies available of the /usr and 
/var directories.  The rpm database is the most critical since it can 
help you determine what else is corrupted/missing.  Of course the rest 
of the data in /var is gone unless it's on backups.

Another option, depending on what kind of system this is, is to remove 
the drive and put it into another system.  Ideally, restore your backups 
to that system, boot off it, and use it to rebuild your original system 
disk.

If you do not have backups, boot into rescue mode (as mentioned above), 
and copy off all of your data including /etc and /home.  Then do a fresh 
install (with a *lot* of luck, you may be able to do an upgrade) and 
reconfigure based on your backup files.  I personally would not attempt 
to try and rebuild everything from scratch once both /usr and /var are 
wiped out - the time to rebuild everything will likely exceed the time 
to reinstall.

	.../Ed

>>-----Original Message-----
>>From: redhat-list-bounces at redhat.com 
>>[mailto:redhat-list-bounces at redhat.com] On Behalf Of bruce
>>Sent: Thursday, April 21, 2005 8:24 PM
>>To: 'General Red Hat Linux discussion list'; 'Lam, Eric'
>>Subject: RE: i just did a rm -rf /*r as root!!!
>>
>>eric...
>>
>>not to be down, but just how would i copy anything to the 
>>screwed up server, when the ssh/rcp/etc.. apps all appear to 
>>have resided in the /usr/bin dir....
>>
>>i was hopeful that using the recover cd might provide a solution....
>>
>>but it seems that no one has a solution, other than 
>>reinstall... which really screws me up!
>>
>>-bruce
>>
>>
>>-----Original Message-----
>>From: redhat-list-bounces at redhat.com
>>[mailto:redhat-list-bounces at redhat.com]On Behalf Of Lam, Eric
>>Sent: Thursday, April 21, 2005 5:11 PM
>>To: bedouglas at earthlink.net
>>Cc: General Red Hat Linux discussion list
>>Subject: RE: i just did a rm -rf /*r as root!!!
>>
>>
>>If I were you, I would copy (by tar or cpio) the files from 
>>another system that has same kernel level. What else you got 
>>to loss now ?
>>
>>-----Original Message-----
>>From: Otto Haliburton [mailto:ottohaliburton at comcast.net]
>>Sent: Thursday, April 21, 2005 7:48 PM
>>To: bedouglas at earthlink.net; 'General Red Hat Linux discussion list'
>>Subject: RE: i just did a rm -rf /*r as root!!!
>>
>>
>>
>>
>>
>>>-----Original Message-----
>>>From: redhat-list-bounces at redhat.com [mailto:redhat-list-
>>>bounces at redhat.com] On Behalf Of bruce
>>>Sent: Thursday, April 21, 2005 6:15 PM
>>>To: 'General Red Hat Linux discussion list'
>>>Subject: i just did a rm -rf /*r as root!!!
>>>
>>>hi...
>>>
>>>i stupidly just did a 'rm -rf /*r' and i understand that there's no
>>
>>way to
>>
>>>redo/undo this command.. it seems to have blown away my 
>>
>>/usr/bin dir..
>>
>>>although, for all i know, i may have screwed up a lot more...
>>>
>>>my question, is there someway that i can reinstall the '/usr/bin'
>>
>>dir.. or
>>
>>>am i pretty much f*ed up. i have fedora core 2. (i've asked th
>>
>>question on
>>
>>>the FC2 list, and they leep telling me that i need to do a complete
>>>reinstall) i thought there was a way to more or less recreate the
>>
>>indoe,
>>
>>>or
>>>that there was some way that you can recover if you haven't done
>>
>>anything
>>
>>>with the drive since the 'rm -rf'... i've seen some
>>
>>postings/information
>>
>>>on
>>>google that kind of discuss this. but i need more understanding...
>>>
>>>this is a critical system that i was putting alot of things on.. i
>>
>>haven't
>>
>>>done anything else to the box after my mistake..
>>>
>>>-bruce
>>>bedouglas at earthlink.net
>>>
>>>
>>
>>There are some very expensive disk recover companies out 
>>there so if it
>>is
>>very important to you I would suggest you get in touch with them they
>>will
>>do a track by track recover of data from the disk.  I don't know what
>>filesystem they support but you can probably google for disk recovery
>>and
>>get the info.  But I can tell you they are very very expensive.
>>
>>

-- 
Ed Wilts, RHCE
Mounds View, MN, USA
mailto:ewilts at ewilts.org
Member #1, Red Hat Community Ambassador Program