I erased everything on my mac by goofing in Terminal.

Question

I erased everything on my mac by goofing in Terminal.

In Mavericks I have been struggling with spotlight taking over my mac on every reboot for 20-30 minutes. Tried everything and had been experimenting with Terminal commands found on the web. I don't remember the command I used but it was supposed to delete the VT-100 index or something like that. When I typed in Terminal, my elbow was bumped and something went wrong in Terminal - some of the text was jumbled around. I tried quitting but it said something was in progress. Later I quit to the Finder, and all seemed well but no spotlight rebuild. A short while later, spotlight kicked in so I figured I've got 5-6 hours to let it run. When I came back, the mac would not recognize my password. Somehow it finally let me in, but when it did the screen was unresponsive. Mouse, keyboard, nothing. So held down the power button. After rebooting I was greeted with my choice of 3 Recovery Partitions. (I have a one internal with 2 partitions and another internal SSD, so 3 made sense.) But no drives. I ran Disk Utility and was happy to see my drives there. However I was horrified when I saw my 1TB drive showing as having 980 gig free.

I booted into Single User mode and it seemed to get a lot of Disk is Write Locked errors.

All the drives show up on the desktop, one drive is completely blank, the other (with the 2 partitions) one is blank and one has a small system on it, with my username….how did it erase everything and keep the user account? And yet delete everything everywhere else?

I’ve run various recovery utilities, and I know my data is there because it recovered a lot of files, for example 7,000 Indesign files with filenames 001,002, etc. Not very helpful, but it’s something.

Anyone have any idea *** happened? Or how I can get my data back, in a way that is useful? I seem to recall in the OS9 days, Norton would reconstruct a directory based on the files, rather than scavenge/reconstruct. I wonder if anything like that would work. Any help would be much appreciated!

iMac, OS X Mavericks (10.9), 12,2 mid-2011 27

Posted on Apr 8, 2015 5:25 PM

Reply

Answer 1

Best reply

Eric Root

Level 10

684,117 points

Apr 9, 2015 6:59 PM in response to mikethemacguy

Data Recovery – Best

Data Recovery – Disk Drill

Data Recovery – Data Rescue

Data Recovery – File Salvage

Data Recovery – Stellar Phoenix

Data Recovery - uFlysoft

Data Recovery – Best

Data Recovery – Disk Drill

Data Recovery – Data Rescue

Data Recovery – File Salvage

Data Recovery – Stellar Phoenix

Data Recovery - uFlysoft

Data Recovery - Recovering Deleted Files

Data Recovery - Recovering Deleted Files (2)

Reply

Answer 2

Apr 9, 2015 7:01 PM in response to Eric Root

Thanks, that was helpful - not quite solved yet though. I was wondering if you are familiar with all of these products, if so which would you recommend to try first to "rebuild" not "scavenge" I used disk drill and Data Rescue, but now I have thousands and thousands of files with no name and no way to catalog them. Thanks!

Reply

Answer 3

Eric Root

Level 10

684,117 points

Apr 10, 2015 6:55 AM in response to mikethemacguy

You are welcome. I have never had the need to use any of these programs, so I can't offer a recommendation.

Reply

Answer 4

etresoft

Level 8

47,120 points

Apr 10, 2015 12:43 PM in response to mikethemacguy

mikethemacguy wrote:

All the drives show up on the desktop, one drive is completely blank, the other (with the 2 partitions) one is blank and one has a small system on it, with my username….how did it erase everything and keep the user account? And yet delete everything everywhere else?

That is odd. Make sure to not use those drives now. Any new files you write could overwrite data that could potentially be recoverable.

If you can still log in to that machine, you can run Terminal again and type "history" and press enter. Then paste the output here. That might give us a better idea of what happened.

I am always very reluctant to give people command-line instructions. I have deleted my own home directory before. Anyone who says you can just be careful and never make a mistake really doesn't use Terminal all that much. I've bookmarked your thread to use it as an example for others.

Reply

Answer 5

Apr 10, 2015 12:50 PM in response to etresoft

I reformatted the internal SSD because there was nothing on it that I needed to recover, and I've been using it exclusively. I won't do anything on the original drives until I've exhausted all attempts to recover the directory and get my files back. If I try to boot from the other partitions it only shows the recovery partitions. So when I type history now, nothing comes up because it's an all new system (Yosemite). I've never even opened terminal until now. I don't suppose there's a way to extract the history from the original drive? I doubt it - this is all I have showing on the partitions that were wiped along with the 240. As I mentioned above I've been able to recover tons of files, but all renamed so pretty much useless.

Reply

Answer 6

Apr 10, 2015 12:51 PM in response to mikethemacguy

oops - when I wrote "the 240" I meant my internal SSD 240 ;-)

Reply

Answer 7

etresoft

Level 8

47,120 points

Apr 10, 2015 1:19 PM in response to mikethemacguy

Sorry, it looks good and wiped. The reason you see a few folders there is that there were some background processes running. They still know where their preferences files and data files (should) live. Since they were still running at the time of the incident, they updated their status, saves preferences, etc. thus re-creating those directories that had been deleted.

Reply

Answer 8

Apr 10, 2015 3:02 PM in response to etresoft

Sounds like you're pretty sure there's no way to rebuild. Do you think any of these "data recovery service" places would have any hope, or am I throwing good money away. I have already "extracted" or "scavenged" - if that's all that can happen, I'm done...I'm kind of in acceptance mode. Ready to wipe it clean and start using the drive again.

Reply

Answer 9

etresoft

Level 8

47,120 points

Apr 10, 2015 4:02 PM in response to mikethemacguy

They know far more about recovering data from hard drives than I do. It can't hurt to contact them. Normally they deal with drives have have physically failed. If the hardware itself is fine, they might be able to recover the data. They will tell if if they can or not or if they can do any better than the "undeletion" tools.

Reply

Answer 10

Apr 10, 2015 10:39 PM in response to etresoft

Great, thanks! I'll post back again if anything new develops.

Reply

Answer 11

Apr 10, 2015 10:45 PM in response to mikethemacguy

BTW I found the command that I used that led to my disaster. I can't be sure, but I do not think it was the command itself that caused the problem. As I wrote in the original post, something happened after/during the typing of the command that caused the problem.

sudo rm -rf / .Spotlight-V100/*

Reply

Answer 12

etresoft

Level 8

47,120 points

Apr 11, 2015 11:50 AM in response to mikethemacguy

mikethemacguy wrote:

BTW I found the command that I used that led to my disaster. I can't be sure, but I do not think it was the command itself that caused the problem. As I wrote in the original post, something happened after/during the typing of the command that caused the problem.

sudo rm -rf / .Spotlight-V100/*

Oh yes. That command itself is the problem. It will erase your entire filesystem. I won't even bother making the tiny correction needed to make it "safe" because it isn't ever safe.

Reply

Answer 13

Apr 11, 2015 12:00 PM in response to etresoft

According to where I found it, all it does is erase the spotlight index. No one in the comments came back with issues (one even thanked the poster). However I did fumble with the keyboard so who knows what was really typed....

http://coolestguidesontheplanet.com/spotlight-control-mac-os-x-mavericks-10-9/

Reply

Answer 14

etresoft

Level 8

47,120 points

Apr 11, 2015 12:30 PM in response to mikethemacguy

Oh, no. That command is 100% guaranteed to erase your filesystem. You added an extra space to trigger that.

In general, it is never safe to try to type in Terminal commands you read on the internet - and that includes anything you see in this forum. Even copy and paste isn't a good idea. Anytime you prefix it with "sudo", you increase the risk significantly. But of course, you didn't know any of that. The lack of a command line used to be a strength of the Mac platform back in the '90s. As an old UNIX programmer, I appreciate having a command line, but it really isn't appropriate for general use.

Reply

Answer 15

Apr 11, 2015 12:40 PM in response to etresoft

Wow...one space and your digital life is over! Amazing. Well thank you for that info, at least I know what happened. If I'm able to recover anything I'll post back for anyone else who might stumble on this.

Reply