I accidentally did a rm -rf * on a wrong directory on my macbook terminal. It appears that the rm command operates just like on a Linux system, where it's irreversible.

But I did back up my Mac to my external HDD so I can restore it using Time Machine, but I wanted to see if anyone knows of another, preferably quicker way to get all of my files back in the directory I used the above command in?

  • With great power comes great responsibility...
    – Solar Mike
    Commented Jul 31, 2019 at 21:09

4 Answers 4


Restoring from backup is the way to go here, there is no magic „undo rm -rf“ command.

  • 2
    You can write an undoable rm (shell script doing an mv "$@" ${HOME}/Trash) but it is risky on any other system you can't rewrite your own version.
    – dan
    Commented Jul 31, 2019 at 14:07
  • 1
    It's not that simple. The trash folder on external drives has a different name. Commented Jul 31, 2019 at 17:46

You do not need to restore your whole machine. You need to restore only one folder. Time machine is much faster than I assume. Seems like a big deal to me since I've been trained never to relay on backup.

Just crank up Time Machine and copy the folder, in which you deleted all the content, back to where ever you had it. I had to go back a level in TimeMachine's display before the restore button became active.

Of course, you you could be missing the absolute latest changes.

enter image description here

Pick what folder you want to restore. I picked my numbers folder.

enter image description here

result: enter image description here

PS: I do not recommend deleting directories from the terminal. It's safer from finder. I've added the following aliases to my bash profile.

alias cp='cp -i'
alias mv='mv -i'
alias rm='rm -i'

Run these command and see how they go. When you delete all the files in a directory with the rm command, you will get asked to approve each file to be deleted. Once you have establish rm is deleting the correct files, use control + c to quit. Then repeat with a backslash \ in front of the rm command to nix the alias version of the command and go to the plain rm command. As a warning, aliases do not cross over to commands with a proceeding sudo. Be careful.

In my account profile I've enhanced the cd command to print out the directory I cd'd into. This reduces slightly the risk of me getting confused over what directory I am in.

# Print current directory after change directory command cd
alias cd='cdir'

# Define a command to change a directory and list the resulting directory
function cdir ()


  \cd "$*"

  • 6
    Adding such aliases is risky, it will byte you as soon as you sit in front of a system where there are not (or differently) defined.
    – nohillside
    Commented Jul 31, 2019 at 8:30
  • 1
    Excellent advice @nohillside. If you don't like the usual mode of these 3 commands, I would recommand to get used to always type rm -i * in every case it's risky.
    – dan
    Commented Jul 31, 2019 at 14:04
  • 1
    Oh man. Wish I knew this. It took me 2-3 hours to restore from Time Machine because I wasn't aware that you could just restore a single directory (this is my first time restoring).
    – anonuser01
    Commented Jul 31, 2019 at 17:47
  • @nohillside I know. It's one of the biggest weakness in Unix. A lot more could be done to offer protection with the Unix rm command. Commented Jul 31, 2019 at 17:54
  • 1
    I don't see it as a weakness :-)
    – nohillside
    Commented Jul 31, 2019 at 19:35

I used to make the same mistake frequently with rm -rf at my last job. One technique that I learned from another engineer was to, instead of navigating the the directory you want to empty, navigate to the parent directory, and use the command rm -rf directory-to-clear/* instead. This isn't foolproof either, but you're much less likely to make the same mistake.

  • 2
    Yeah, typing out the directory name explicitly definitely could make these problems less likely. Thanks for the suggestion. I'll try to use that in the future.
    – anonuser01
    Commented Jul 31, 2019 at 17:46
  • 2
    Probably a delete directory script would be handy. At least you could avoid putting a space between / and *. Commented Jul 31, 2019 at 17:58

Copying from a backup is much more efficient than anything. If you want to take the hard route, stop using your operating system immediately and look into using testdisk on it from an external OS installation.

For backing up from your time machine drive do the following:

Plug in your time machine backup, and then open up terminal.

Open up two finder windows. In one window, navigate to the deleted directory on your local hard drive. In the other finder window, navigate to the same directory (your backup copy) in the time machine hard drive.

Go back to terminal and type:cp -R then go to your time machine directory folder that is your backup copy, and drag it to the terminal. For example if you did rm -rf* ~/Downloads/ or rm -rf* /Users/Myhomefolder/Downloads/

your terminal should now look like this:

cp -R /Volumes/TimeMachineHD/Datedfolderyouwanttorevertto/Users/Myhomefolder/Downloads

then enter /* and a space.

Next drag go to the original deleted directory in your local drive using finder, and drag that folder to the terminal.

your terminal should now look like this:

cp -R /Volumes/TimeMachineHD/Datedfolderyouwanttorevertto/Users/Myhomefolder/Downloads/* /Users/Myhomefoldername/Downloads

then press backspace to line your curser next to the last letter in the terminal, and type /.

The final command in your terminal should look like this:

cp -R /Volumes/TimeMachineHD/Datedfolderyouwanttorevertto/Users/Myhomefolder/Downloads/* /Users/Myhomefoldername/Downloads/

If you originally deleted a protected folder in root, the be sure to enter sudo in the terminal before entering the command.

Be sure you have the correct command and directories, then press enter to run the command. The back up will now copy to your hard drive.

  • Are you sure about the paths on the TimeMachine volume, shouldn’t there be a version/date in it? Also, restoring via command line copies any extended attributes added by Time Machine back onto your main drive which you should remove afterwards to avoid strange access/permission issues later on.
    – nohillside
    Commented Jul 31, 2019 at 4:23
  • @nohillside You are correct. This is what happens when I do this on my phone instead of being able to see it visually on my mac. I will edit. Also, i am unaware of how to remove the cooied permissionns from terminal.
    – DanRan
    Commented Aug 2, 2019 at 19:12
  • It's always tricky to do these things from memory. On my system the path looks like /Volumes/Time\ Machine/Backups.backupdb/Mithos/2019-08-02-190630/Macintosh\ HD/Users/pse/Documents/. And actually Downloads is excluded from TimeMachine usually.
    – nohillside
    Commented Aug 2, 2019 at 20:03
  • @nohillside Thanks! I will make edits. Do you manually exclude downloads from your backups I assume?
    – DanRan
    Commented Aug 2, 2019 at 20:08
  • Ah, right, Downloads is something I've excluded manually :-)
    – nohillside
    Commented Aug 3, 2019 at 13:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .