What happens step by step when using "rm -rf directory"?

Question

Let's assume that I have 150 GB of data in a directory and I have accidentally run this command for a directory.

Suddenly I realised, I should not put "/" in the beginning of directory and I cancelled command with Ctrl+C after a few seconds.

The directory is still there and there are currently folders from a to z but if it was windows I would know what is gone and what is not. I tried to test this command in a test server and I assumed that the command will delete folders starting with 0-9, then to a-z. In my tests, I couldn't verify this theory because either everything is gone or nothing got deleted.

Still curious though. Is that the case ? How this command exactly works step by step ? Did I lose some data ?

Answer 1

How this command exactly works step by step ?

Recursively. rm will not delete a directory if its not empty. For that reason, it will first recurse into it, and delete its contents ("regular" files). This means that the unlinking process starts at the deepest level in your directory hierarchy, and goes up removing directories once they've been emptied. I guess you could put it this way (even though there may be slight variations) :

/
---- somedir                        <-- (5)
-------- a                          <-- (4)
------------ a                      <-- (3)
---------------- a                  <-- (2)
-------------------- somefile1.txt  <-- (1)
-------------------- somefile2.txt  <-- (1)
-------------------- somefile3.txt  <-- (1)
-------------------- [...]
---------------- b                  <-- (2)
---------------- [...]              <-- (2)
------------ b                      <-- (3)
------------ [...]                  <-- (3)
-------- b                          <-- (4)
-------- [...]                      <-- (4)

     ^   ^   ^   ^   ^
    (5) (4) (3) (2) (1)

By the way, rm has a -v option which will help you understand what happens as it runs.

-v, --verbose
    explain what is being done

Did I lose some data ?

Yes (that's very likely), at the bottom of your directory hierarchy. Unlinking a file is really quick, and if these files were small enough, it didn't take long for the kernel to get rid of data blocks associated with each one of them.

Go as far as you can within your directory: files like /dir/a/e/g/r/c/somefile (assuming the alphabetical sorting goes that far) are likely to be gone... Of course, the amount of data you lost depends on how quickly you hit Ctrl + C.