What Happens When You Run “rm -rf /”

I’ve known for a long time to stay away from the short, sweet and simple “rm -rf /” command.  It deletes every file on any writable filesystem mounted by a *nix system, but what exactly happens if you do run it?  

Do green leprechauns jump off the screen to warn you that you shouldn’t do it?  Not quite.

Here’s a video with the verbose option set to make it a little bit more interesting.  I’m running it in a virtual machine so I can capture video of all the “action” – it was a bit slow to complete, but I’ve gone ahead and increased how quickly it runs to not be nearly so boring.

Enjoy!

At the very end you can see that X crashes on the VM when I click where the trash icon would be. Rebooting results in a GRUB error 15.

If you’d like to hear a horror story about someone running rm recursively, check it out here: http://www.ee.ryerson.ca/~elf/hack/recovery.html

  • http://david.clavel.free.fr/blog/ David

    That’s the funniest post I’ve ever seen ! It’s like Ubuntun-Jackass ! I love it ! Great experiment, I never thought about doing that :-D

  • http://happylinuxthoughts.blogspot.com Happy Linux Guy

    Holy shit, you read my mind or something. I was thinking about doing the same thing. I have actually done it before, just to see how much fun I could have, but I didn’t record it or anything. I never thought about doing it in a VM. Very Cool.

  • http://www.commmanddotcom.com Adam

    Nice.

    -A

  • http://ibeentoubuntu.blogspot.com Daeng

    I think the most interesting part is that we got to see the operation complete in the terminal: the system was still (minimally) operating, even without any system files left.

  • http://www.fsckin.com/ Wayne

    Yeah it was fun to watch it the first time around… then I did it on a VM, which was pretty dog slow… it doesn’t seem like it in the video since it’s 2x speed after I type in the password to run a root terminal.

  • Venkatesh Nandakumar

    i accidentally created a folder named “*” in /etc folder, and to remove it did “rm -rf /etc/*”, was too late before i even realised what was happening.

  • http://digg.com Digg User

    @Daeng

    That’s a side effect of how Linux handles files on disk. The files wont actually be deleted from disk while a process is still making use of them.

    The same is true for upgrades. if you were to overwrite /usr/sbin/apache2 with an updated version, the system will continue to run the old /usr/sbin/apache2 until the process is stopped and restarted.

    Which is one of the reasons system updates are less painful than the windows equivalent as we don’t have to reboot to replace files that are currently in use.

  • Dex

    The nuclear hand grenade.

  • Jack

    I believe the reason it continues to seem to run is because the operation didn’t remove everything. Eventually it got to the “rm” executable and removed that. After that, I don’t believe it can continue the process.

    There may still be files left, but you’ve deleted “ls” at that point, so you can’t see them.

    That is my theory.

  • http://- Stufkan

    isn’t it just reading from the memory in the end? Or what?

  • Dave

    Files are not removed from the disk, they are unlinked from the directory structure. Any file that is still open remains accessible. The errors occur when running processes try to open a file, which, after rm -rf, it can’t find.

  • Somebody

    It’s more fun to run dd if=/dev/zero of=/dev/sda1 – the machine lives a bit longer since the file system cache isn’t immediately trashed.

  • Bacon

    I unplugged my hard disk once. There was no swap space on it so it helped delay the inevitable crash a lot.

    The kernel spewed a lot of I/O error messages but the console kind of worked for a couple of minutes(X crashed almost immediately).

    @Jack. No, if rm says it’s complete, it is complete. rm runs once and doesn’t respawn for every file.

  • http://matt.mcinvale.org/ matt

    that was scary to watch with 3 root terminals open >:)

  • http://uncensored.citadel.org ig

    Cool. I recognize the music — it’s a tune called “Popcorn” which was the first song ever to be released that was recorded using electronic instruments. Obviously this is a modern cover of it — who is it???

  • http://risingsun.jp AlexTheStampede

    Uhm…. I’m pretty sure i’ve heard that song before, some Amiga game?

  • Ix

    Dunno about Amiga games, but I’m fairly certain that song appears in tetris, not positive so I might be wrong though…

  • davidblund

    LOL! That’s great!

    In fact, I did just that during the first days of being a Linux user. I thought I was about to remove all the files in the current folder (without being asked a lot of questions) by typing “rm -rf /*”.
    Before pushing [ENTER] I actually considered whether or not the “/” was suppose to be there. But then I thought “nah, the system won’t let me remove any critical files without asking me first, would it?”. Well, because of the mysterious non-verbose mode, I didn’t realise what was going on till the operation was completed and the prompt seemed almost as feature rich as MS DOS. Is that you Ballmer, installing DOS on my machine? Echo? :D

  • jbuckley

    The song *is* “Popcorn”, originally by Billy Preston, and was a minor hit in 1972 or thereabouts. He was a friend of George Harrison and the Beatles, and had quite a successful career, mostly as a studio musician on the keyboards. Died a few years ago.

  • Ix

    Yeah, *nix systems just assume you meant to do that, even when you didn’t mean to. I had a good teacher who warned me about that before the distro we were using finished installing, but I imagine anyone who didn’t have a mentor or teacher to guide them has a similar story about wiping out the machine.

  • tsella

    i wonder how you captured the video?

  • Ix

    @tsella

    He mentions in his description that he’s running the command on a virtual machine and recording it with the real one.

  • Diazamet

    The thing is, everyone thinks this is the worst thing to happen if you’re on a *nix system and that for viruses, this is the ultimate achievement.

    I think a scarier scenario is ‘rm -rf ~’ because if you accidentally do a recursive ‘rm’ in /, you have a chance to kill it and you can re-install the OS. If you accidentally ‘rm -rf ~’ if you haven’t backed up recently, kiss your docs goodbye.

    I know you may be able to recover them but my point is, you don’t need to be root to perform devastating mistakes!

  • http://www.blogspot.sk sir.peterson

    I did “rm -rf *” in / on hp-ux at work once, everyone was expecting a running Oracle DB :)

  • http://jdserver.homelinux.org jdm64

    What is actually happening with any “rm” command is the file system is just removing the inode (a special link to the exact address on the hard drive) of the file. The data is still there (and should be able to be accessed if the program knows how to directly access the data) until it is over written by a new file.

    Currently running programs will continue to function normally (because they are in memory) unless they need to open a new file not already in memory.

    I’ve done this on a Mac, and it was hilarious! The system was mostly usable, although I couldn’t open any new program that wasn’t already open and in memory.

  • http://www.parkgallery.org travelgirl

    fyi — “popcorn” was not the first “electronic” instrumental to be released to the general public… at a bare minimum, “… [Wendy] Carlos hit platinum sales status with her 1968 recording ‘Switched-On Bach,’ which propelled the Moog synthesizer into the public consciousness and won three Grammy Awards…”

  • d0nk3y

    Haha – that’s the theme tune played during an old Commodore 64 game called ‘Trolley Wally’

  • Pingback: Digg “Linux Nation” for Thursday November 1st 2007 » fsckin w/ linux

  • Mark

    Sad to say, I accidentally did this on a production machine… on the “system disk” in a VAX/VMS system about 30 years ago…. I was on the system disk, doing maintenance (of course), logged in as the administrator and needed to recover some disk space…

    well – I got it ALL back, LOL

    Luckily the data disk was intact, so I wasted a couple hours reloading VMS from a handful of those HUGE 10 or 12 inch diameter disk packs… I think all the disks I loaded were less than one CD worth of info!!

    Luckily my buddies got a kick out of it and there were only like 4 of us using that system… But unlike *NIX the VAX actually DID lock up on us all as the files were apparently not just “unlinked”!

    sigh… what a newb I was back then!

    enjoy, friends!

  • http://www.fsckin.com/ Wayne

    Nice story mark, did you check out the link I added to the old Usenet post? I really got a kick out of that one.

  • Eric

    I did rm -rf /* on a freebsd server at work thinking I was deleting just the contents of my current directory. Luckily I realized before it got all the way through /bin and stopped it.
    To fix it I copied the /bin directory from a sister server onto a samba share on the affected server and then slid it into place. I had to run cp and ls from the samba share in order to accomplish this…

  • observer

    BTW, the song is based on Peer Gynt Suite No. One, the Hall of the Mountain King, by Edward Grieg (late 19th century) and was used in different computer games, such as Manic Miner on ZX Spectrum, besides others

  • Skyegod

    My worst was probably chmod 000 * as root – from root

    That was not pretty – as it was not a local machine, the machine was 6 hours drive away.

    Not a good position to be in, luckilly we were able to get a contracter in from the area, he was able to login runlevel 2 and start to revert permissions.

  • http://www.fsckin.com/ Wayne

    chmod 000 – yikes that is pretty bad too.

  • http://www.hackosis.com Shane

    Haha, not like Windows. It isn’t going to ask you “Are you sure you want to delete your entire fs? lol

  • http://www.geekandhype.com pickupjojo

    OMG, he’s dead now! o_o

  • http://www.opusforfour.com nighthawk808

    That’s about the only appropriate thing you can do with (or to) a system running Gnome. Frees up plenty of space for KDE, though.

  • http://www.mikewestwood.com Mike W.

    Hey – OK, this is a sill question – but what did you use to get the screen capture?

    Thanks!

  • http://www.pelikoira.net k00pa

    Wouh gnome still works! What if you to the same trick in windows… :P

  • Pingback: Video: lo que sucede al ejecutar rm -fv /* como r00t « Javier Aroche @ Wordpress

  • O S X

    Please .zip a hi-res qt on-line / url4download.us

  • http://kerblam.co.uk Christopher

    Reminds me of what happens if you unplug the C: drive from a Windows machine once it’s booted and finished loading… Hilarity ensues ;)

  • Pingback: Today’s Picnic: 5 nicknacks | r3ck0rd's Blog

  • Pingback: Today's Picnic: 5 nicknacks | r3ck0rd's Blog

  • http://intotheunknown.co.uk Christopher

    Looks like someone needs to install Akismet ;)

  • http://nmwoodworks.com/tech BillinDetroit

    Wow … all that spam. I feel bad about breaking the string!

    At any rate, I’ll be linking to this site in an hour or so from http://nmwoodworks.com/tech (the tutorial on getting Outlook running on Linux was pretty good. My remaining hassle is that I can’t find the ()*&&$E#@_) CD I wrote the downloaded Outlook install stuff to and I doubt if MSFT is going to just want to flip me a replacement disk.

    I’m kind of hoping to find a local friend who has it so that I can see if I can get it and ActiveSync (a POC program if ever there was one) to talk to my T-Mobile DASH phone / PDA. If I can, then I’ll drink the kool-aid and buy the software again.

    BTW, since XP + MSIE7 trashed my file system, I’ve bought a 1T external drive. Cron and rsync are my new friends.

  • http://www.fsckin.com/ Wayne

    DAAAAAAM Akismet died… something about not upgrading the site to WP 2.6 in a timely fashion. Sorry people!

  • http://crystalnunez.seitenclique.net/quincy-i11/le-mystere-tisha-bras.html le mystere tisha bras

    pxzkn jzoi fwhn krcfizb

  • http://sandragonzalas.justfree.com/undercouc0/steve-crum-film-critic.html steve crum film critic

    nubv figzba tscfk xijw

  • http://melissagilden.freeweb7.com/atlanta-41/clip-download-free-music.html clip download free music

    atpgb bajcqfg yniclqz