Makes me wish we had a transactional file system and the ability to force certain deletes to verify even if run as root with the -rf flags so we could roll back this type of thing.
Transactional filesystems have been implemented at considerable expense. To be clear, I mention transactions at a high enough level to encompass deleting a subdirectory (most reasonably implemented filesystems have support for tiny transaction that ensure that metadata is available on disk in a consistent fashion).
When I say considerable expense, I mean _very_ considerable expense. I know of no efficient implementation and only one practical implementation: TxF. TxF is not very fast either, it requires double the writes and, on top of that, is not easy to use. Microsoft is considering deprecating TxF due to the cost of continuing it's maintenance at the expense of other features [1]
I think a more reasonable model for what you want is filesystem snapshots. This is a feature that can be implemented with relatively high performance and without causing terribly large amounts of complication (needing to transact file descriptors, etc.)
My setup is pretty simple and could recover from this with few problems: I use ZFS and have zfSnap configured to take a snapshot every hour, saved for five days. So I'd lose potentially the last hour's worth of changes to /usr/local, but that's unlikely to be big.
FreeBSD; I didn't trust any of the ZFS implementations for linux (I'm not sure there is one that works for your root filesystem yet?) and Solaris didn't find all of my hard drives.
If you're thinking of switching there really isn't much difference between FreeBSD and Linux (at least if you're talking about a traditional Linux like Slackware); most of the admin commands work like Linux did up until 5 years ago, and obviously the UI is just KDE or whatever you like.
