recover files after using rm -R -v command.

Question

Level 1

0 points

recover files after using rm -R -v command.

Hi

Hope someone maybe able to help me with this issue.

We had storage issues on our Apple XRAID and on the RAID it stored approx 700 user home folders. A lot of these areas where fairly sizable so we were advised that we can run a command in terminal which can clear the trash folders in a users home directory.

This would certainly help clear some of the unnecessary space that was being taken up.

So in terminal a command was run:

rm - R -v /Volumes/RAID/Homedirectories/*/.Trash

I believe the last statement would have interrogated each user home folder and deleted the trash folder.

We found though that whilst this command worked, it also deleted all user home folders.

I have a massive dilemma now as all the work is lost and our backup software wasn't working at the same time so I not able to do a restore.

I have tried various undelete software to interrogate the RAID and see if it can recover files. I have used:

Stella Phoenix, Rstudio for Mac and Disk Warrior.

These programs have not been able to recover anything.

I was going to use a freeware tool called TestDisk and photorec buts its going to take about 3 days for it to run on the XRAID as its 3tb in size.

Does anyone think I could try something else to help me find the accidently deleted data. With the rm commands that have been run is there any way to recover from it?

Thank you

Xserve + XRAID 3.5TB, Mac OS X (10.5.8), School

Posted on Sep 9, 2010 6:21 AM

Reply

Answer 1

Sep 9, 2010 6:59 AM in response to ranj.bassi

You might want to check this: http://subrosasoft.com/OSXSoftware/index.php?mainpage=product_info&productsid=1

That said, don't get your hopes up too high. When a file is deleted, the data is generally left, but the entry in the directory structure that specifies the file's name and it's location on the disk is removed, and the bitmap that specifies what part of the disk is free space is updated.

In a practical sense, the file is lost. A recovery program can search for files by scanning the free-space on the disk for patterns of bytes that indicate a file of a particular format (images, PDFs, etc. are pretty easy to locate this way, for example), though the file name is probably lost. If a file is large, it's possible that the file is stored in several discontinuous parts of the disk, in which case that file may be unrecoverable.

Also, the disk will write over the old files with new data, and may overwrite old files when you open existing files as part of its automated disk defragmentation scheme.

So... The lesson is: no backup = working without a safety net.

Reply

Answer 2

Sep 9, 2010 11:07 AM in response to ranj.bassi

Sorry to hear about the mass deletion ranj.bassi

Unfortunately as it has been said there is no simple solution for recovery and I won't bother commenting on those issues as I'm no more experienced than most, however I am curious as to why the command didn't work as expected?

rm - R -v /Volumes/RAID/Homedirectories/*/.Trash

In my mind this could only delete .Trash folders and their contents as all other paths would be ignored no? Was this the command that caused you trouble or was there a typo or something? For instance a space before the .Trashes would not be good :S For people trying similar things with the rm command the -i flag to start off with can be helpful.

Reply

Answer 3

Tony T1

Level 6

10,247 points

Sep 9, 2010 11:38 AM in response to taylor.henderson

I am curious as to why the command didn't work as expected?

Not sure if this caused it, but there is a space between "-" and "R".

Reply

Answer 4

Sep 9, 2010 2:05 PM in response to Tony T1

I think that would be the equivalent of

rm "-"
rm "-V"
rm "R"
rm "/Volumes/RAID/Homedirectories/*/.Trash"

First three failing because there are no files named that and the last one because it is not recursive for a directory.

Sorry if stealing your post here OP. I've used the "photorec" utility to save some vacation photos after the memory card went swimming and it had options for all sorts of files. Freeware as well.

Reply

Answer 5

rccharles

Level 6

13,037 points

Sep 10, 2010 12:56 PM in response to ranj.bassi

You might find mass deletes safer with the find command. Here is how to test before deleting:

find ~/Desktop/iMac -type f -exec ls -l {} \;

Robert

Reply