Remove, real fast.

March 18, 2009 1:32 PM

I'mAnIdiotFilter: Any way to "walk back" an rm -rf in OSX?

So, tired and punchy, I screwed up my syntax and instead of running rm -rf in the trash to get rid of a pesky file, I ran it ... from my home directory.

Any way to get back the stuff it wiped before I killed the command? I've done this a time or two with Linux and managed it, but I've no idea what to do on this machine. It's 10.4.11, if that matters.

posted by the luke parker fiasco to computers & internet (13 comments total)

I am afraid to say I think the only way to get any data back is going to be using some kind of recovery software.

I have had good success with cgsecuritys tools.
posted by moochoo at 1:43 PM on March 18

If it is critical, don't do anything with your computer — shut it off, in fact — until you can run a data recovery tool like Data Rescue.
posted by Blazecock Pileon at 1:47 PM on March 18

worst case scenario if you have to send the drive out to someone, give gillware a shot. They have great customer service, won't charge you if they can't recover the files and if you say Apple sent you they'll give you special pricing. Also WAAAAAAY cheaper than drive savers.
posted by hummercash at 1:54 PM on March 18

I'd shut down the machine ASAP, then boot in target disk mode, connect to another Mac via FireWire, and try data recovery software. If you don't shut down the machine can write swap or other files over the deallocated blocks.

If you don't have another Mac you might be able to boot to the data recovery software boot disk and run from there.

If the blocks get overwritten then even Drivesavers might not be able to help you.

I've used Data Rescue and had good results. The one gotcha with Data Rescue is that it refuses to recover files to the drive it's recovering from; you need some kind of external disk to recover to.

Good luck with that.
posted by caphector at 1:58 PM on March 18

Eeep! You've been running Time Machine to keep backups of everything, right? Right?
posted by browse at 2:05 PM on March 18

Time machine was introduced in 10.5.

"The one gotcha with Data Rescue is that it refuses to recover files to the drive it's recovering from" what? If you don't understand how data recovery works, you should probably not be posting in this thread.

You should probably turn off your computer, and find an expert service to do this for you. Otherwise, whatever you did with linux will probably be fine ... 10.* is based off bsd after all, and maybe post whatever magic you possess to make that work? Personally I am curious. Good luck. Losing data sucks.
posted by shownomercy at 2:11 PM on March 18

Whatever you did with Linux will probably not work. BSD isn't Linux, and HFS+ isn't ext3. Data recovery software or service is probably your only option. Don't use the drive again until you are ready for recovery or you will quite likely destroy any chance of recovery.
posted by chairface at 2:23 PM on March 18

Data Rescue 2 and File Salvage both have an undelete function. Purchasing the retail copy, you can boot from the CD and recover files to an external hard drive.
posted by now i'm piste at 2:35 PM on March 18

If you don't have an external hard drive, this would be an excellent excuse to buy one. Afterwards, you can use your new external hard drive with backup software or, if you ever upgrade to OS X 10.5, Time Machine.
posted by Blazecock Pileon at 3:08 PM on March 18

Had good luck with DiskWarrior on a similar problem a while back.
posted by sophist at 3:34 PM on March 18

In future, I would seriously try relauching the Finder or rebooting the box before resorting to the CLI sledgehammer in the Trash, as a fellow Unix geek.

That being said, I think Data Rescue is probably your best option.
posted by fairytale of los angeles at 3:40 PM on March 18

Thanks for the info, everyone. Unfortunately, I'm not someplace where disk recovery or any of that is really an option. Fortunately, I at least realised my colossal stupidity quickly and killed the command, so I didn't lose much.

One thing I did lose, though, is the blue Desktop icon that comes up in the left sidebar of the finder. Any ideas where I could grab another one of those?
posted by the luke parker fiasco at 7:34 PM on March 18

You can get it back by going to the Finder menu, choosing Preferences, clicking Sidebar and checking the box for Desktop.
posted by caphector at 12:04 AM on March 19