0

I executed rm -rf /* as root while in the /var directory on a RHEL7 system. I pressed Ctrl+C as soon as I realized to stop the operation, but I am now unable to log into the system. I don't know how many files are deleted.

Is there any way to repair Linux?

terdon
  • 242,166
Nullpointer
  • 553
  • 4
  • 10
  • 25

2 Answers2

3

"Is there any way to repair Linux?"

Technically, yes. How much time and effort do you want to put in?

Realistically, it depends on how much damage was done before the Ctrl-C. Unless you have backups, or this is a VM with snapshots, or you have a root filesystem like ZFS that has snapshots that you can roll back, it's unlikely that you'll be able to recovery without a significant level of effort.

Your first step should be to boot from a LiveCD type media. In this way, you can mount your various filesystems, and start investigating what's missing. Until you know how severe the damage is, you can't know the extent to which you'll need to go to fix it.

If you managed to interrupt the rm quickly enough, then it's possible that all that's missing is a few critical libraries (is anyone that lucky?), and you may find that simply copying files from the LiveCD back into your filesystems may be sufficient to allow you to boot. It may take some experimentation to succeed. If the damage is extensive, you'll potentially learn a lot, especially if you have to remake all the device trees under /dev. Also making sure that things that are supposed to be links are copied as links, and such. Good times.

More than likely you will need to just reinstall your system. At least the LiveCD method will allow you to copy off any data that did survive.

Tim Kennedy
  • 19,697
  • How can i find missing file using single user mode ? It's a rhel7 has default XFS filesystem – Nullpointer Nov 13 '20 at 05:13
  • 1
    You have to go file by file, directory by directory, or automate such activity. find / -print > all_files.txt 2>&1. Run something like that on your broken system, and a known good system that's the same version of RHEL, and compare the two. You could also start with du -sh /usr or du -sh /lib and compare the sizes of those directories between the broken and healthy system. The bigger the differences between the two systems, the harder it will be to recovery without reinstalling. – Tim Kennedy Nov 13 '20 at 14:53
  • everyone has no clone system every time, Is it only way to repair linux box ? I mean any utility or quick way to identify linux core deleted files ? find / -print > all_files.txt 2>&1 is give system files+software+3th party lib but first we need only system file in order to up linux box. Is there any consistence way to this to avoid something missing file issue in future ? – Nullpointer Nov 17 '20 at 09:16
  • 1
    having backups is the standard way to avoid this. most people only start backing up after the first time this happens to them. – Tim Kennedy Nov 17 '20 at 19:29
2

Boot using a rescue disk. Backup anything that's left of your files in /home. Reinstall. Then start taking regular backups.

Chris Davies
  • 116,213
  • 16
  • 160
  • 287