What Happens When You Run “rm -rf /”
Linux, Video October 31st, 2007
I’ve known for a long time to stay away from the short, sweet and simple “rm -rf /” command. It deletes every file on any writable filesystem mounted by a *nix system, but what exactly happens if you do run it?
Do green leprechauns jump off the screen to warn you that you shouldn’t do it? Not quite.
Here’s a video with the verbose option set to make it a little bit more interesting. I’m running it in a virtual machine so I can capture video of all the “action” – it was a bit slow to complete, but I’ve gone ahead and increased how quickly it runs to not be nearly so boring.
Enjoy!
At the very end you can see that X crashes on the VM when I click where the trash icon would be. Rebooting results in a GRUB error 15.
If you’d like to hear a horror story about someone running rm recursively, check it out here: http://www.ee.ryerson.ca/~elf/hack/recovery.html
Are you interested in FREE SUBSCRIPTIONS for qualified professionals to eWeek, PC Magazine, PC World, and many more? Click here!
Tags: Video
That’s the funniest post I’ve ever seen ! It’s like Ubuntun-Jackass ! I love it ! Great experiment, I never thought about doing that
Holy shit, you read my mind or something. I was thinking about doing the same thing. I have actually done it before, just to see how much fun I could have, but I didn’t record it or anything. I never thought about doing it in a VM. Very Cool.
Nice.
-A
I think the most interesting part is that we got to see the operation complete in the terminal: the system was still (minimally) operating, even without any system files left.
Yeah it was fun to watch it the first time around… then I did it on a VM, which was pretty dog slow… it doesn’t seem like it in the video since it’s 2x speed after I type in the password to run a root terminal.
i accidentally created a folder named “*” in /etc folder, and to remove it did “rm -rf /etc/*”, was too late before i even realised what was happening.
@Daeng
That’s a side effect of how Linux handles files on disk. The files wont actually be deleted from disk while a process is still making use of them.
The same is true for upgrades. if you were to overwrite /usr/sbin/apache2 with an updated version, the system will continue to run the old /usr/sbin/apache2 until the process is stopped and restarted.
Which is one of the reasons system updates are less painful than the windows equivalent as we don’t have to reboot to replace files that are currently in use.
The nuclear hand grenade.
I believe the reason it continues to seem to run is because the operation didn’t remove everything. Eventually it got to the “rm” executable and removed that. After that, I don’t believe it can continue the process.
There may still be files left, but you’ve deleted “ls” at that point, so you can’t see them.
That is my theory.
isn’t it just reading from the memory in the end? Or what?
Files are not removed from the disk, they are unlinked from the directory structure. Any file that is still open remains accessible. The errors occur when running processes try to open a file, which, after rm -rf, it can’t find.
It’s more fun to run dd if=/dev/zero of=/dev/sda1 – the machine lives a bit longer since the file system cache isn’t immediately trashed.
I unplugged my hard disk once. There was no swap space on it so it helped delay the inevitable crash a lot.
The kernel spewed a lot of I/O error messages but the console kind of worked for a couple of minutes(X crashed almost immediately).
@Jack. No, if rm says it’s complete, it is complete. rm runs once and doesn’t respawn for every file.
that was scary to watch with 3 root terminals open >:)
Cool. I recognize the music — it’s a tune called “Popcorn” which was the first song ever to be released that was recorded using electronic instruments. Obviously this is a modern cover of it — who is it???
Uhm…. I’m pretty sure i’ve heard that song before, some Amiga game?
Dunno about Amiga games, but I’m fairly certain that song appears in tetris, not positive so I might be wrong though…
LOL! That’s great!
In fact, I did just that during the first days of being a Linux user. I thought I was about to remove all the files in the current folder (without being asked a lot of questions) by typing “rm -rf /*”.
Before pushing [ENTER] I actually considered whether or not the “/” was suppose to be there. But then I thought “nah, the system won’t let me remove any critical files without asking me first, would it?”. Well, because of the mysterious non-verbose mode, I didn’t realise what was going on till the operation was completed and the prompt seemed almost as feature rich as MS DOS. Is that you Ballmer, installing DOS on my machine? Echo?
The song *is* “Popcorn”, originally by Billy Preston, and was a minor hit in 1972 or thereabouts. He was a friend of George Harrison and the Beatles, and had quite a successful career, mostly as a studio musician on the keyboards. Died a few years ago.
Yeah, *nix systems just assume you meant to do that, even when you didn’t mean to. I had a good teacher who warned me about that before the distro we were using finished installing, but I imagine anyone who didn’t have a mentor or teacher to guide them has a similar story about wiping out the machine.
i wonder how you captured the video?
@tsella
He mentions in his description that he’s running the command on a virtual machine and recording it with the real one.
The thing is, everyone thinks this is the worst thing to happen if you’re on a *nix system and that for viruses, this is the ultimate achievement.
I think a scarier scenario is ‘rm -rf ~’ because if you accidentally do a recursive ‘rm’ in /, you have a chance to kill it and you can re-install the OS. If you accidentally ‘rm -rf ~’ if you haven’t backed up recently, kiss your docs goodbye.
I know you may be able to recover them but my point is, you don’t need to be root to perform devastating mistakes!
I did “rm -rf *” in / on hp-ux at work once, everyone was expecting a running Oracle DB
What is actually happening with any “rm” command is the file system is just removing the inode (a special link to the exact address on the hard drive) of the file. The data is still there (and should be able to be accessed if the program knows how to directly access the data) until it is over written by a new file.
Currently running programs will continue to function normally (because they are in memory) unless they need to open a new file not already in memory.
I’ve done this on a Mac, and it was hilarious! The system was mostly usable, although I couldn’t open any new program that wasn’t already open and in memory.
fyi — “popcorn” was not the first “electronic” instrumental to be released to the general public… at a bare minimum, “… [Wendy] Carlos hit platinum sales status with her 1968 recording ‘Switched-On Bach,’ which propelled the Moog synthesizer into the public consciousness and won three Grammy Awards…”
Haha – that’s the theme tune played during an old Commodore 64 game called ‘Trolley Wally’
[...] all for the week, if you haven’t already, check out the video where I go and delete every file on a Linux machine while it’s still running. You might [...]
Sad to say, I accidentally did this on a production machine… on the “system disk” in a VAX/VMS system about 30 years ago…. I was on the system disk, doing maintenance (of course), logged in as the administrator and needed to recover some disk space…
well – I got it ALL back, LOL
Luckily the data disk was intact, so I wasted a couple hours reloading VMS from a handful of those HUGE 10 or 12 inch diameter disk packs… I think all the disks I loaded were less than one CD worth of info!!
Luckily my buddies got a kick out of it and there were only like 4 of us using that system… But unlike *NIX the VAX actually DID lock up on us all as the files were apparently not just “unlinked”!
sigh… what a newb I was back then!
enjoy, friends!
Nice story mark, did you check out the link I added to the old Usenet post? I really got a kick out of that one.
I did rm -rf /* on a freebsd server at work thinking I was deleting just the contents of my current directory. Luckily I realized before it got all the way through /bin and stopped it.
To fix it I copied the /bin directory from a sister server onto a samba share on the affected server and then slid it into place. I had to run cp and ls from the samba share in order to accomplish this…
BTW, the song is based on Peer Gynt Suite No. One, the Hall of the Mountain King, by Edward Grieg (late 19th century) and was used in different computer games, such as Manic Miner on ZX Spectrum, besides others
My worst was probably chmod 000 * as root – from root
That was not pretty – as it was not a local machine, the machine was 6 hours drive away.
Not a good position to be in, luckilly we were able to get a contracter in from the area, he was able to login runlevel 2 and start to revert permissions.
chmod 000 – yikes that is pretty bad too.
Haha, not like Windows. It isn’t going to ask you “Are you sure you want to delete your entire fs? lol
OMG, he’s dead now! o_o
That’s about the only appropriate thing you can do with (or to) a system running Gnome. Frees up plenty of space for KDE, though.
Hey – OK, this is a sill question – but what did you use to get the screen capture?
Thanks!
Wouh gnome still works! What if you to the same trick in windows…
[...] sería ejecutar un rm -rf /* como root. Hoy encontré un video que grabó Fsckin w/ linux de lo que pasa al ejecutar este comando en [...]
Please .zip a hi-res qt on-line / url4download.us
Reminds me of what happens if you unplug the C: drive from a Windows machine once it’s booted and finished loading… Hilarity ensues
[...] http://www.fsckin.com/2007/10/31/what-happens-when-you-run-rm-rf/ will explain what happens. [...]
[...] http://www.fsckin.com/2007/10/31/what-happens-when-you-run-rm-rf/ will explain what happens. [...]
Looks like someone needs to install Akismet
Wow … all that spam. I feel bad about breaking the string!
At any rate, I’ll be linking to this site in an hour or so from http://nmwoodworks.com/tech (the tutorial on getting Outlook running on Linux was pretty good. My remaining hassle is that I can’t find the ()*&&$E#@_) CD I wrote the downloaded Outlook install stuff to and I doubt if MSFT is going to just want to flip me a replacement disk.
I’m kind of hoping to find a local friend who has it so that I can see if I can get it and ActiveSync (a POC program if ever there was one) to talk to my T-Mobile DASH phone / PDA. If I can, then I’ll drink the kool-aid and buy the software again.
BTW, since XP + MSIE7 trashed my file system, I’ve bought a 1T external drive. Cron and rsync are my new friends.
DAAAAAAM Akismet died… something about not upgrading the site to WP 2.6 in a timely fashion. Sorry people!
pxzkn jzoi fwhn krcfizb
nubv figzba tscfk xijw
atpgb bajcqfg yniclqz
ugkem vsojpx mjaz
ncmoy pywe qasip kzucvxr
iyzqb wiby
thzjrv
sohib oprzftw
That’s a lot of spam :/
FYI, Ubuntu 8.04 warns you if your run “sudo rm -rf /”:
“rm: cannot remove root directory `/’”
… but says nothing to “sudo rm -rf /*” ^^
irgxw
aevipy hzqvtnl esqi
yljkse drlipnh
puhigm tjlxibe
humvqkw xzdjp qyhfec
hrmo
cpetis
fylzt lzbqmt hrusg wvzo
uhnkc etqiudw
gwzn yintmkc hveslw zscn
xgjzka
oytu
Dumbass
Hi,
I just experienced this. I copied the command from a blog (can’t remember where.)
Anyways, not only did it delete almost everything, it also traversed down the network, into my file server and also deleted a huge amount of file before I noticed it and stopped it.
What happened was it also deleted the .gvfs folder. Since the .gvfs folder also has pointers to any network folder that you’ve accessed, it also traversed those files. Problem is I generally access my network files using admin rights, so it just went to my .gvfs folder, to my network shares (with admin rights) and just started deleted everything. Luckily I have backups on a seperate pc.
It was really scary. Taught me a good lesson..