Bash: Determine partially deleted content [closed]

I wanted to delete a symbolic link

rm -rf name

but instead used

rm -rf name/

I think it took me a second to realize the mistake and cancelled it. This is a massive directory with hundreds of gbs of data. So it would take a long time to delete anyway.

1. Since the command was incomplete, are the partially processed files restored (like mv) or are they already permanently deleted?

2. If they are irrecoverably deleted, is it possible to find out what has been deleted? Is it deleted in the the same order as ls (alphabetical)?

3. Is there a log of files deleted from the system?

OS is Scientific Linux. File system is nfs (df -T).

Answer

Note that I still hold the question to be off-topic here… but it can’t hurt to have explicit answers to every branch of the question in one place, and if this answer gets migrated to SuperUser with the question, all the better:

---

1. Since the command was incomplete, are the partially processed files restored (like mv) or are they already permanently deleted?

Just like an individual rename() syscall during a recursive mv within a single filesystem, an individual unlink() of a single file is atomic — it either completes or it doesn’t on a file-by-file basis. There’s no “half-done” state, and no larger transaction spanning multiple files that can be rolled back; each individual directory entry will either be deleted, or not.

Likewise, any file which has no remaining directory entries (aka “hardlinks”) pointing to it or open file handles at the end of an unlink() will immediately be subject to deletion — though the filesystem is at its own discretion as to whether, when, and under what circumstances to actually wipe or reuse the underlying blocks where its data was stored, or the tracking data which specified which blocks were associated with each now-deleted file.

2. If they are irrecoverably deleted, is it possible to find out what has been deleted? Is it deleted in the the same order as ls (alphabetical)?

Not in general. There exist specific backend filesystems that could be used that can track either changes between snapshots or even do point-in-time recovery (though these are generally commercial and thus only available if your administrator was paying for them), and monitoring tools (such as sysdig) that record individual syscalls.

If your system administrator is running ZFS or btrfs with cronned snapshots, for instance, they can compare the list of files that currently exist to those that existed as of the last snapshot.

3. Is there a log of files deleted from the system?

Not in general. If your site is running Sysdig Cloud, or a commercial fileserver with non-default behavior, then maybe — but your sysadmin staff would be the people who could answer that question.