I just deleted everything on my Windows system through the ubuntu subsystem. Can I recover the data?

I wanted to delete all my Ubuntu related files from the Ubuntu subsystem within Windows. So I just used sudo rm -rf /* in the Ubuntu home directory.

I did sudo because earlier there were a lot of permissions denied. Now when there were fewer permissions denied, I started getting all sorts of other errors from Windows and then I realized it was also deleting files outside of Ubuntu.

Now everything is working weird even in Windows. I just canceled the command with Ctrl + C as soon as I realized it, but too much has been damaged. Is there a way to fix this? Is there a way to reverse the last command?

Solution 1:

I'll offer as much help as I can here, but more condolences than anything. There's no "undo" in WSL/Linux (well, at least not without a Restore Point), no Recycle Bin, and the files that are deleted this way don't even go into the Windows Recycle Bin. Even if they did, repairing Windows file-by-file when multiple system files have been damaged is probably an exercise in futility.

Edit/Update: It's worth checking if you have a recent System Restore Point in Windows. There's a chance you can get back to some semblance of "normal" Windows functionality by selecting the most recent Restore Point. That said, it's likely that your rm went into the Windows Program Files and/or ProgramData, which would impact third-party apps as well.

As @matigo commented, plan on restoring from backup. If no backup is available, plan on reinstalling Windows and all apps. At the very least (assuming you can't use a Restore Point), use the Windows installer's "Repair" functionality (may also be available by booting with F11 or some other hotkey). But don't be surprised if it's beyond "repairable" for the same reasons as above. You may need to access another computer to download and create the Windows 10 installation media.

Do you have any important documents or work on the Windows side that was lost? Hopefully it didn't progress to C:\Users (a.k.a. /mnt/c/Users under WSL), but if it did (and if you didn't have a backup) then you should look into file recovery options, at least if you have an HDD. It's important to stop using the computer until you do this, as any writes to the drive could overwrite important data that you might otherwise be able to recover.

It also might be wise to go ahead and back up any important files or documents that are still on there before reinstalling Windows. Depending on the current state of your computer, you might want to create a Rescue USB from which you can boot to access the files and back them up. Again, depending on the state of your computer, you may need to get access to another computer with which to create the bootable USB.

You've done that "ultimate no-no command", but you thought you were safe to do so since you were in a "virtual environment". But WSL isn't completely or totally virtualized. It's power comes from its deep interoperability with Windows, including automatic mounting of Windows drives in WSL. And with great power comes ... err, sorry.

Note that the right way to remove all WSL Ubuntu files would be:

Uninstall the Ubuntu distribution from within Windows by going to "Apps & Features", selecting "Ubuntu" (or the version that was installed from the Microsoft Store) and "Uninstall".
Or, wsl --unregister <distroname> where the distro name is likely "Ubuntu" (but can be determined with wsl -l -v for confirmation). This will still leave an "Ubuntu" entry in the Start Menu and in Apps & Features, though, so the first method is preferable.

Solution 2:

There is a way to fix this, but usually not from within Ubuntu.

Background

Files being removed aren't actually removed. They are just marked as removed and the space they took up on disk is being marked as "free". So as long as you don't write in that space, the file is physically still there, but the disk (and therefore the OS) doesn't know about the file.

Data recovery

You can use NTFS recovery software to restore many of the files lost. There're tools running on Ubuntu or Windows. There're tools for free and those you have to pay for. They differ greatly in how much data they're able to restore and how long it'll take. Usually Windows-native tools work better, since NTFS is an invention by Microsoft and there's no 100% native support for it on other operating systems.

Experience

I've had great success with a software called GetDataBack NTFS ¹ (now called GetDataBack Pro Data Recovery it seems, I'm not affiliated). It took about a day to search a whole 1 TB drive for files and about another day to actually recover those files to a 2nd drive. About 85 to 95 % of the data deemed to be lost was recovered. Other tools I'd tried only managed to recover up to 30 to 40 % of the data.

How to recover

Try to prevent any write access to the affected drive to avoid the "deleted" files being overwritten. There're ways to mount a drive in read-only mode (how to do this on Windows or Ubuntu), but it can be sufficient to not write on the disk intentionally in this case.

Turn off the machine with the affected drive
Remove the affected drive from your machine and hook it up in another machine.² Make sure that machine won't boot from the affected drive.³
Start up the other machine
(Optional: Mount the device in read-only mode as mentioned above)
Run the recovery tool of your choice to analyze the affected drive
Restore the files found to just another (3rd) drive (doesn't matter whether internal or external)
Copy any required files from the 3rd drive back to the affected drive at the correct place

This assumes you want to continue using your affected drive as-is. Actually you should skip step 7, use the recovery tool to restore only the most important files and then proceed to fully erase the affected drive and install a fresh copy of Windows, then proceed to copy the restored data back (make sure to make a backup of the non-deleted files you'll need).

Note: There are other tools being able to find and restore deleted files from within Ubuntu (either your local installation or a live usb/disc), which are free to use. When I tried them, they either took exceptionally long to find files at all or found only a small fraction of what was lost. YMMV

^{¹ The software costs about USD 80 for a lifetime license, which is absolutely worth it imho. You only need to purchase it to actually restore the files, though. You can analyze your drive for free and get a file tree you can search through to check if the files you need to recover have been found. Again: not affiliated, just a happy user.}

^{² The operating system required on the 2nd machine depends on the recovery software being used, e.g. GetDataBack runs on Windows.}

^{³ You can usually open a boot menu to select your booting drive at startup of the machine via pressing a certain button on your keyboard. Usually this is F12 nowadays, but the exact key may differ for your specific main board. Consult the manual to find out which key to press. You can also set up a permanent boot order (setting the order of devices to check for bootable operating systems) via the BIOS/UEFI settings of your main board, also accessible via pressing another specific key during startup (usually DEL). That key also differs, though, so make sure to check your main board manual.}