bash 在“rm -R /*”之后做什么
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/44808321/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
What to do after a "rm -R /*"
提问by storca
I was working on my website under root and I commit the worst thing that a linux user can do : rm -R /*instead of rm -R ./*.
I've stopped the process when I saw that it was taking too long...
I manage to reinstall lubuntu with an usb key, is this a good idea or are there other ways to reverse this big mistake ?
我在 root 下在我的网站上工作，我犯了一个 linux 用户可以做的最糟糕的事情：rm -R /*而不是rm -R ./*. 当我看到它花费了太长时间时，我已经停止了这个过程......我设法用 USB 密钥重新安装了 lubuntu，这是一个好主意还是有其他方法可以扭转这个大错误？
Thanks to any answer
感谢任何答案
回答by Birchlabs
Short answer: no.
简短的回答：没有。
Long answer: depends on the filesystem and on how rmis implemented. It's possible that rm merely unlinks the file; the inode (marked "deleted") and data may still remain. And even if the inode is hard-deleted, the data may remain. But in either case: there is a risk that your actions since that time have already written data over your old data or over the location of the soft-deleted inode. This can happen even with temporary files, or file descriptors (such as for sockets or processes) or pagefile [well, unless that thing has its own partition].
长答案：取决于文件系统以及如何rm实现。rm 可能只是取消链接文件；inode（标记为“已删除”）和数据可能仍会保留。即使 inode 被硬删除，数据也可能保留。但无论哪种情况：都存在风险，即您从那时起的操作已经将数据写入旧数据或软删除 inode 的位置。即使是临时文件，或文件描述符（例如套接字或进程）或页面文件[好吧，除非那个东西有自己的分区]，这也可能发生。
I wouldn't recommend trying to relink soft-deleted inodes, or infer from your data how to reconstruct hard-deleted inodes. Sure, maybe for irreplaceable memories this would be worth it (take the drive to a data forensics specialist), but there's near-guaranteed corruption somewhereon the disk. I would certainly not attempt to run a production system off a disk recovered like that.
我不建议尝试重新链接软删除的 inode，或从您的数据推断如何重建硬删除的 inode。当然，对于不可替代的记忆，这可能是值得的（将驱动器交给数据取证专家），但是磁盘上的某处几乎可以保证损坏。我当然不会尝试在像这样恢复的磁盘上运行生产系统。
I recommend one of the following:
我推荐以下之一：
- restoring from your regularly-scheduled backup
- wiping everything and starting again (you have all your website files stored under source control and stored remotely, right?)
- redeploying your Docker image (this wasan immutable deployment, right?)
- 从定期安排的备份中恢复
- 擦除所有内容并重新开始（您将所有网站文件存储在源代码控制下并远程存储，对吗？）
- 重新部署你的 Docker 镜像（这是一个不可变的部署，对吧？）
