What happens if we do rm -rf ../**? Can we restore the data?

us flag

I did something like:

$ cd /A/B/
$ rm -rf ./*
$ rm -rf ../**

Due to network issues my system disconnected from Ubuntu. When I came back there were no files or folders in the /A folder.

user535733 avatar
cn flag
Using `rm` to experiment with the `.` and `..` locations seems like a foolish way to investigate what those locations are and how to use them. Many better, non-destructive ways to learn about them exist.
AdamOutler avatar
jp flag
The second `*` in `../**` is redundant. The `*` means all files and folders matching any pattern. eg. `a*b` would be anything starting with a and ending with b. When you say `**` you're saying "match 0 or more of any character and match 0 or more of any character". While the `**` does match all subdirectories, that was handled by the `rm -r` already.
code_dredd avatar
cn flag
Short of using digital forensics software for data recovery, no, there isn't anything you can do to restore affected data. This is similar to pressing Shift+Del in Windows - there's no recycle bin to go to. It's generally beneficial to check the command's documentation before trying out experiments where your data is at stake. **TL;DR:** You screwed up :(
marcelm avatar
cn flag
The question title asks about `./*`, but it's the `../**` that caused OPs problems. The question title should be edited to better reflect that. (I'd edit, but the post has been stuck on a pending edit for a while now)
Carl Witthoft avatar
ng flag
I seem to recall explicit warnings in the earliest Unix books about not doing stuff like this, especially not `sudo rm -rf /*` . "Everything old is new again"
us flag
@AdamOutler Your analysis of the glob `**` is not valid with most modern shells. Take a look [here](
AdamOutler avatar
jp flag
@doneal24 if you `rm -rf ../*` or `rm -rf ../**` it will delete all files and folders within the directory above your current directory. Not sure what you're talking about.
us flag
@AdamOutler The globs `./*` and './**` are expanded differently. `**` does not mean what you think it means. Practical effect in the `rm -rf` example is nil but your explanation is not correct.
ng flag

rm removes files. It does not put them in Trash so they cannot be restored by normal methods.

Also the -rf tag does two things:

The -r tag stands for recursive which means that it deletes the path or file you specify AND everything else below it.

The -f tag stands for force, which means that the operation will complete without any further prompts.

To answer your question about syntax, remember that ./ is the path of the current directory and ../ is the path of the "parent" directory (the path above the current directory).

So if you run rm -rf ../* while under /A/B/, then you are deleting everything under /A/.

If you're going to use rm -rf, be aware that this is a very powerful command that will indiscriminately and permanently delete everything in the path you specify.

Your only option to recover files from this operation are advanced data recovery tools like photorec/testdisk. These applications are not always successful in restoring data, and any further use of your device decreases the likelihood that they will recover anything.

The best path is to restore from backups.

xxz avatar
us flag
thanks, my point is ,i did rm in B location. but how the files gone in A location. i didnt get it. you see my question for same
Nmath avatar
ng flag
Edited to include more details about the path syntax. See:
Rodney avatar
cn flag
I once meant to type `rm var -rf` but accidentally typed `rm /var -rf` so I deleted a big system directory instead of a subdirectory of a website. This command can be very destructive with the slightest mistake. Also if I hadn't been root the command would have failed so there's another lesson. Luckily it was just a VM.
us flag
@xxz You had `/A/B` as your working directory but to told rm to delete `../**`, e.g., files and directories one level up.
vn flag

When you run rm -rf ../** in directory /A/B, it goes back to directory /A and removes everything in there, since .. is the parent directory.

If you want to be able to "restore" data, you should consider running a filesystem with active snapshots enabled.

Both ZFS and BTRFS have snapshots implemented, and auto snapshots can be configured.

If you for instance have configured hourly snapshots for the last 24 hours, and daily snapshots for the last 14 days, you could roll back to any of those snapshots for a given filesystem at any time.

The exact configuration of automatic snapshots will vary with the chosen filesystem.

The reason this "just works" is that both filesystems implement "copy-on-write", where every change to the filesystem is written to a new location - so no data is removed until the snapshots and the pointers to the old data expire.

cn flag

What you actually did is that (../**).

as you can see you put the double dot in the given command which deletes everything that comes before your working DIR.

Now let's see how it work. Just imagine we have a location directory with the name XYZ,

# pwd
# mkdir XYZ

# cd XYZ

# pwd

As per the above command, I created a directory. which can be considered as -> /A/B

now when you run the below-mentioned command it will only delete everything within the working directory which is /XYZ

rm -rf ./**

But when you run the same command with a double dot icon the command itself will change its location of the running directory and delete everything which comes before /XYZ from there only but since the user working in a folder that exists in that directory which is getting delete at that time only that folder will be left undelete and everything will get deleted.

It's quite hard to tell whether you can recover your data or not but you can use photorec which helps you to recover your data but it will change the recover files name randomly so if you know what was there you can else I don't think so you can recover your data .

hope this answer your question.

in flag

Your are recursively deleting files and folders from a folder. In one case the parent folder.

It would help a little if you told us where you were but if this is sensitive then you are likely somewhere under /home or /opt or /var as other places have boilerplate names you should not be afraid of sharing.

You can restore the files from an external source, but if you deleted bin folders there may be issues with your system stability.

You can mount the disk to another machine for restoration in this case.

I would expect you to have backups of the major trees. In the cloud (and even locally) you can fall back to a recent whole of disk image and just restore /home, /var, and anything that you have backed up as being relatively volatile.

NB. - restoring the tree with cp or rsync can be a de facto defrag.


Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.