Эксперимент с полной очисткой Linux: как восстановить систему после команды rm -rf

Of all the Linux commands, rm is notorious. It's easy to completely wipe out your system with one mislaid rm command as root. I knew not to, but I ran that command on purpose anyway. Here's why. Why run rm -rf? Setting an example This was intended just as an experiment. I've been using Linux long enough that I know not to run dangerous commands like rm without a plan. I wanted to see what would happen on a modern Linux system if I tried this. I would have a degree of safety since I was only running this in a throwaway Linux virtual machine in VirtualBox. I wouldn't attempt something like this on a daily driver. I also wanted to see how well I could actually recover if the worst ever happened to a Linux machine. I would take advantage of VirtualBox's abilities to clone a virtual machine and roll back to earlier snapshots. On a regular system, this could include restoring from backups. The Linux system I'm destroying A disposable enviornment As I mentioned previously, I would be running this command on a virtual machine. This is a perfectly ordinary Debian installation created in VirtualBox, my distro of choice. It's completely stock, having gone through the standard Debian installation process. It is a dual-core machine with 4GB of RAM. I didn't think a system where I was going to try to delete everything would need a lot of horsepower. The software was also lightweight. I'd chosen my go-to Xfce desktop, with the standard Debian desktop software. What happened when I ran the command An appreciated warning before mass destruction Even though I was using a virtual machine, I still felt some trepidation over what I was about to do. I took a deep breath, opened up the terminal, and typed out this innocent-looking command: sudo rm -rf / Don't do this. What this command means is that this will delete every file starting at the root directory, or "/" (not to be confused with the root user), going down recursively through every subdirectory and "forcing" deletion, meaning proceeding without any kind of prompting, whether a file exists or not. In short, this would delete every file in the Linux installation. I typed this out and pressed Enter. I was expecting total Linux destruction. Instead, a got a simple error message: rm: it is dangerous to operate recursively on '/' rm: use --no-preserve-root to override this failsafe It seems the developers of the GNU version might have finally done something about rm's legendarily unsafe behavior, at least when it comes to running it on the root directory. The only thing between me and total Linux annihilation was a command-line option. I pretended that I was foolhardy enough to proceed by adding it: sudo rm -rf / --no-preserve-root This meant that rm would now delete files in the root directory. Seriously, do not do this. What happened to the system? Everything and nothing I was expecting a more spectacular Linux destruction. Instead, I got an error message in the desktop, and the screen went black except for a blinking cursor. I was expecting the current environment to remain in the memory, including Xfce and the shell. When I'd done this on purpose years ago when switching a machine to another distro in my early Linux days, that's what I remember happening. I tried switching between virtual terminals to see if I could log in, but when I pressed the Alt and function keys, nothing happened. I didn't panic, since I was expecting the system to now be unusable, plus I was only in a virtual machine anyway. I didn't panic. I simply turned off the machine Could I recover? The short answer is "yes" I wanted to test the recovery strategy I'd devised. This was an obviously casual one. I would just use VirtualBox's snapshot function. Before I started my attempt at total Linux destruction, I created a snapshot of the virtual machine's state. I wanted to see if I could roll back. Even better, I was only destroying a clone of my environment, so I would have nothing to lose if I couldn't recover. The shutdown menu when I was powering off the virtual machine already had a helpful option to restore to a previous snapshot, which I did. The virtual machine restarted into the snapshot I'd created, and I was back at my Debian Xfce desktop as before, as if nothing had ever happened. The lessons of my experiment This whole experiment in Linux destruction shows why Linux is such a favorite among programmers and other technical types. It doesn't put many barriers between you and what you want to do, even if there is a risk of doing something catastrophic if you're not careful, like deleting all your files. Linux inherits a lot of ideas from Unix, and that includes being "by programmers, for programmers." The main takeaway is that you should be careful before you press Enter when typing commands, especially when you're root and running potentially destructive commands like rm. This episode also shows that you can recover if you have the right strategy. On a real system, like an important server, I would have implemented a real backup strategy. The ability to fall back to snapshots shows that you can recover from something like this if you have a previous plan in place. It's like an insurance policy: you hope you never need it, but you'll be glad you had it if the worst happens.