Deleted files from linux using find and need to fix

up vote
-3
down vote

favorite

I was trying to remove this trojan that copied itself across my system and after successfully seeing all instances of the trojan using find / -name trojan I then did find / -delete -name trojan and immediately starting seeing "Operation not permitted" on files that were not related to the trojan so I killed the command with Ctrl-C but now I am having some problems.

From what I can tell, my important files are still there, and I haven't been able to figure out what it deleted, however I cannot open a new terminal window, I get a message saying '/bin/bash' No such file or directory, however if I open the file explorer it shows that bash is in /bin as well as all the other bin files. Additionally I still have a terminal open, but the only commands that work are the builtin ones (cd, echo, etc) If I try to do even ls, I get that /bin/ls cannot be found. Similarly if I type any command that is not builtin I get the same message but it tells me exactly where the file is (I can see it in explorer) bu then says no such file or directory.

How can I recover from this? Is there a way to find out what my system is missing?

edited Jan 24 at 0:42

Jeff Schaller

31.7k847107

asked Jan 23 at 23:57

fjames003

132

5

You deleted essential files, there is no incantation that will bring them back. Backup what you need if it is still there and reinstall the system.
â€“Â Rui F Ribeiro
Jan 24 at 0:03

@RuiFRibeiro you don't think I could boot from a live usb and install essential files, any command that was running is still running so I know commands work, they just aren't linked properly now. Anything that I have thought to check is still there.
â€“Â fjames003
Jan 24 at 0:13

2

You're not supposed to put -delete in front of -name.
â€“Â Chai T. Rex
Jan 24 at 0:14

1

@fjames003 too much work trying to recover the system, either restore it from backups or reinstall. No use crying over spilt milk.
â€“Â Rui F Ribeiro
Jan 24 at 0:29

3

yes. find does things in the order they appear on the command line. by default, predicates are ANDed (-a) with previous predicates, but you can use -o to override that and OR them. You can also use parentheses (escaped in sh ( ... )) to control order of evaluation. find's command line is a fairly complex language and takes some getting used to. e.g. find / -delete -name trojan means "find everything under /, then delete all matches, then search for files with name trojan". find / -name trojan -delete means "find everything under / with name trojan and delete them".
â€“Â cas
Jan 24 at 1:14

Â |Â
show 7 more comments

up vote
-3
down vote

favorite

How can I recover from this? Is there a way to find out what my system is missing?

edited Jan 24 at 0:42

Jeff Schaller

31.7k847107

asked Jan 23 at 23:57

fjames003

132

5

You deleted essential files, there is no incantation that will bring them back. Backup what you need if it is still there and reinstall the system.
â€“Â Rui F Ribeiro
Jan 24 at 0:03

@RuiFRibeiro you don't think I could boot from a live usb and install essential files, any command that was running is still running so I know commands work, they just aren't linked properly now. Anything that I have thought to check is still there.
â€“Â fjames003
Jan 24 at 0:13

2

You're not supposed to put -delete in front of -name.
â€“Â Chai T. Rex
Jan 24 at 0:14

1

@fjames003 too much work trying to recover the system, either restore it from backups or reinstall. No use crying over spilt milk.
â€“Â Rui F Ribeiro
Jan 24 at 0:29

3

yes. find does things in the order they appear on the command line. by default, predicates are ANDed (-a) with previous predicates, but you can use -o to override that and OR them. You can also use parentheses (escaped in sh ( ... )) to control order of evaluation. find's command line is a fairly complex language and takes some getting used to. e.g. find / -delete -name trojan means "find everything under /, then delete all matches, then search for files with name trojan". find / -name trojan -delete means "find everything under / with name trojan and delete them".
â€“Â cas
Jan 24 at 1:14

Â |Â
show 7 more comments

up vote
-3
down vote

favorite

How can I recover from this? Is there a way to find out what my system is missing?

edited Jan 24 at 0:42

Jeff Schaller

31.7k847107

asked Jan 23 at 23:57

fjames003

132

How can I recover from this? Is there a way to find out what my system is missing?

edited Jan 24 at 0:42

Jeff Schaller

31.7k847107

asked Jan 23 at 23:57

fjames003

132

edited Jan 24 at 0:42

Jeff Schaller

31.7k847107

edited Jan 24 at 0:42

Jeff Schaller

31.7k847107

edited Jan 24 at 0:42

Jeff Schaller

31.7k847107

asked Jan 23 at 23:57

fjames003

132

asked Jan 23 at 23:57

fjames003

132

asked Jan 23 at 23:57

fjames003

132

5

You deleted essential files, there is no incantation that will bring them back. Backup what you need if it is still there and reinstall the system.
â€“Â Rui F Ribeiro
Jan 24 at 0:03

@RuiFRibeiro you don't think I could boot from a live usb and install essential files, any command that was running is still running so I know commands work, they just aren't linked properly now. Anything that I have thought to check is still there.
â€“Â fjames003
Jan 24 at 0:13

2

You're not supposed to put -delete in front of -name.
â€“Â Chai T. Rex
Jan 24 at 0:14

1

@fjames003 too much work trying to recover the system, either restore it from backups or reinstall. No use crying over spilt milk.
â€“Â Rui F Ribeiro
Jan 24 at 0:29

3

yes. find does things in the order they appear on the command line. by default, predicates are ANDed (-a) with previous predicates, but you can use -o to override that and OR them. You can also use parentheses (escaped in sh ( ... )) to control order of evaluation. find's command line is a fairly complex language and takes some getting used to. e.g. find / -delete -name trojan means "find everything under /, then delete all matches, then search for files with name trojan". find / -name trojan -delete means "find everything under / with name trojan and delete them".
â€“Â cas
Jan 24 at 1:14

Â |Â
show 7 more comments

5

You deleted essential files, there is no incantation that will bring them back. Backup what you need if it is still there and reinstall the system.
â€“Â Rui F Ribeiro
Jan 24 at 0:03

@RuiFRibeiro you don't think I could boot from a live usb and install essential files, any command that was running is still running so I know commands work, they just aren't linked properly now. Anything that I have thought to check is still there.
â€“Â fjames003
Jan 24 at 0:13

2

You're not supposed to put -delete in front of -name.
â€“Â Chai T. Rex
Jan 24 at 0:14

1

@fjames003 too much work trying to recover the system, either restore it from backups or reinstall. No use crying over spilt milk.
â€“Â Rui F Ribeiro
Jan 24 at 0:29

3

yes. find does things in the order they appear on the command line. by default, predicates are ANDed (-a) with previous predicates, but you can use -o to override that and OR them. You can also use parentheses (escaped in sh ( ... )) to control order of evaluation. find's command line is a fairly complex language and takes some getting used to. e.g. find / -delete -name trojan means "find everything under /, then delete all matches, then search for files with name trojan". find / -name trojan -delete means "find everything under / with name trojan and delete them".
â€“Â cas
Jan 24 at 1:14

You deleted essential files, there is no incantation that will bring them back. Backup what you need if it is still there and reinstall the system.
â€“Â Rui F Ribeiro
Jan 24 at 0:03

@RuiFRibeiro you don't think I could boot from a live usb and install essential files, any command that was running is still running so I know commands work, they just aren't linked properly now. Anything that I have thought to check is still there.
â€“Â fjames003
Jan 24 at 0:13

You're not supposed to put -delete in front of -name.
â€“Â Chai T. Rex
Jan 24 at 0:14

@fjames003 too much work trying to recover the system, either restore it from backups or reinstall. No use crying over spilt milk.
â€“Â Rui F Ribeiro
Jan 24 at 0:29

yes. find does things in the order they appear on the command line. by default, predicates are ANDed (-a) with previous predicates, but you can use -o to override that and OR them. You can also use parentheses (escaped in sh ( ... )) to control order of evaluation. find's command line is a fairly complex language and takes some getting used to. e.g. find / -delete -name trojan means "find everything under /, then delete all matches, then search for files with name trojan". find / -name trojan -delete means "find everything under / with name trojan and delete them".
â€“Â cas
Jan 24 at 1:14

Â |Â
show 7 more comments

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

find / -delete -name trojan

attempted to delete all files on the root filesystem. The command you meant to use is

find / -name trojan -delete

Sorry to be the bearer of bad news but your system is FUBAR. You should boot up from a live CD, copy on an external drive any important personal file might have been left on the system, then do a fresh reinstall.

answered Jan 24 at 8:23

dr01

15.1k114768

add a commentÂ |Â

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f419226%2fdeleted-files-from-linux-using-find-and-need-to-fix%23new-answer', 'question_page');

);

Post as a guest

Name

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

find / -delete -name trojan

attempted to delete all files on the root filesystem. The command you meant to use is

find / -name trojan -delete

answered Jan 24 at 8:23

dr01

15.1k114768

add a commentÂ |Â

up vote
2
down vote

accepted

find / -delete -name trojan

attempted to delete all files on the root filesystem. The command you meant to use is

find / -name trojan -delete

answered Jan 24 at 8:23

dr01

15.1k114768

add a commentÂ |Â

up vote
2
down vote

accepted

find / -delete -name trojan

attempted to delete all files on the root filesystem. The command you meant to use is

find / -name trojan -delete

answered Jan 24 at 8:23

dr01

15.1k114768

find / -delete -name trojan

attempted to delete all files on the root filesystem. The command you meant to use is

find / -name trojan -delete

answered Jan 24 at 8:23

dr01

15.1k114768

answered Jan 24 at 8:23

dr01

15.1k114768

answered Jan 24 at 8:23

dr01

15.1k114768

answered Jan 24 at 8:23

dr01

15.1k114768

add a commentÂ |Â

draft saved

draft discarded

draft saved

draft discarded

Post as a guest

Name

搜尋此網誌

mjhjmtu