Pitfalls of Accidental Deletion in Linux and Simple Recovery Techniques

Suicidal Commands

The Linux system (the following also applies to macOS) is famous for being open-source and free. However, sometimes it is a bit too open. I have been caught by its extremely open nature several times (mainly due to poor usage habits). Therefore, I have summarized these experiences to share for everyone’s entertainment.

The most classic example of "suicide" is the following command:

sudo rm / -rf

This will destroy your Linux system. Obviously, in Windows, this would be equivalent to formatting the system drive from within the operating system, which is strictly prohibited.

A similar command is mv. For example, the following command, while not as severe as rm, is almost enough to destroy your system:

sudo mv /* /root

There are many other high-risk commands, such as dd. In Linux or macOS, using dd to burn images is very common, but you must be absolutely sure of the target disk identifier. Otherwise, you might regret it deeply. For example:

sudo dd bs=4m if=xxx.img of=/dev/rdisk0

And then your system is gone! This is my personal experience. While burning an image for a Raspberry Pi, I accidentally wiped my MacBook’s system and spent a long time reinstalling it over the network.

Accidental Deletion

Of course, although commands like sudo rm / -rf are dangerous, we aren’t stupid enough to run them directly. They are mostly for entertainment and don’t usually lead to dangerous consequences. More serious consequences are often caused by accidents—unexpected ones (especially for beginners).

For example, the following command is very common:

sudo mv a/* b

The intention is simple: move everything from directory a in the current path to directory b in the current path. It looks safe and doesn’t affect the system itself. However, what if you accidentally type an extra space?

sudo mv a /* b

I’m sorry, but all you can do is laugh (or cry). You can only hope that you reacted quickly enough to press Ctrl+C. Otherwise, you’re in for a lot of trouble. This will move all your system files into the b directory, causing almost all commands to stop working (including mv). This is a pit I fell into not long ago, wasting a lot of time. By the way, the rm command carries the same risk.

Recovery Techniques

Now that we’ve finished the sad stories, let’s talk about something more encouraging.

If you accidentally delete system files, especially in a destructive way, I might not be able to help much. However, if you just accidentally deleted a text file—for example, a code script you just finished writing but forgot to back up (especially long code that you spent a lot of effort on, which makes you want to give up on life)—it is still possible to recover it, and the process is not particularly complicated.

First, let’s create a file:

echo 'Physical cosmology is a branch of astrophysics that studies the large-scale structure of the universe and fundamental questions such as its formation and evolution. The research object of cosmology is the motion of celestial bodies and its first cause, which for a long time in human history was part of metaphysics. As a science, cosmology originated from the Copernican principle and Newtonian mechanics, which pointed out that celestial bodies and objects on Earth obey the same physical principles and explained the motion of celestial bodies. This branch is now known as celestial mechanics. It is generally believed that physical cosmology originated from Einstein's general theory of relativity in the twentieth century and astronomical observations of extremely distant celestial bodies.' > test.txt

Then, use rm test.txt to delete it. Next, execute:

sudo grep -a -B 5 -A 10 'The research object of cosmology is the motion of celestial bodies' /dev/sda5 > results.txt

Parameter explanation:

1. grep is a text search based on regular expressions;
2. -a means –binary-files=text, treating binary files as text files;
3. The -B and -A options specify the number of lines before and after the string;
4. ’The research object of cosmology...’ is some content from the original text file;
5. /dev/sda5 is the hard disk device, which can be checked via the df command;
6. > results.txt outputs the results to the results.txt file.

This command is quite time-consuming and may even report out-of-memory errors. Regardless, after the command finishes, we can look for the content we need in results.txt. If you are lucky, the deleted content will be there. If you modified test.txt multiple times, the original text fragments might appear multiple times in results.txt. To locate the text content, you can use programming tools to read results.txt and search (because if the text fragment you provided is too common, results.txt might be huge, and ordinary text editors might crash). For example, using Python:

s = open('results.txt').read()
# Check if the string exists
print('The research object of cosmology' in s) # If True, there is hope!

idx = s.index('The research object of cosmology')

# Check if it is the content we just deleted
# If not, you can update s = s[idx+len('...'):] and repeat
print(s[idx-100:idx+100]) # Gradually adjust the 100 parameter until you find the deleted content.

I didn’t expect Linux to have such a trick up its sleeve. I only found this via Google after accidentally deleting a script a few days ago. Indeed, technical knowledge is often accumulated through lessons of blood and tears.

References

http://coolshell.cn/articles/2822.html

When reposting, please include the original link: https://kexue.fm/archives/4491

For more details on reposting, please refer to: Scientific Space FAQ