#69 1998 · Pixar · Film production / technology operationsincentive-flip
After a stray command erased 90% of Toy Story 2, Pixar's leadership decided the one thing not worth finding out was who typed it
the problem
A catastrophic technical failure created enormous pressure to identify and hold someone accountable
background
During production of Toy Story 2 in 1998, a Unix delete command run from the wrong directory propagated across Pixar's network and erased roughly 90% of the film's files — character models, sets, animation, two years of work — in minutes. When the recovery team reached for the studio's own backup system, built specifically to prevent exactly this scenario, they found it had been silently failing for about a month; the safety net meant to catch this failure had itself failed unnoticed.
The instinctive organizational response to a disaster this expensive is to find out who caused it — whoever typed the command becomes the person a studio under enormous financial and schedule pressure needs to hold accountable, both to satisfy leadership above and to feel like the problem has been addressed. Pixar had that same pressure and the same easy target available.
the move
The film was ultimately recoverable only because supervising technical director Galyn Susman, working partly from home after having a baby, had been keeping her own informal, unauthorized copy of the production files on her home computer — colleagues drove to retrieve the machine and used it to rebuild the lost work. In the aftermath, co-founder Ed Catmull explicitly ruled blame-finding out of the recovery process: by his own account, Pixar 'never sought out who was responsible,' reasoning that identifying and punishing the individual wouldn't help anyone learn from the failure, and instead prioritized restoring the film, then fixing the backup system, then adding safeguards against a repeat.
the payoff
Toy Story 2 was fully recovered and delivered on its original schedule; the studio rebuilt its backup infrastructure with automated testing, distributed storage, and access restrictions on destructive commands rather than around any single person's conduct.
what came after
Catmull's account of the incident in his book Creativity, Inc. became a widely cited case for blameless post-incident review, now standard doctrine in software engineering and operations culture (the same principle behind modern blameless postmortems), and is frequently pointed to as the reason Susman's informal backup existed in the first place — a culture that doesn't punish deviation from official process is the same culture where someone quietly keeps a personal safety net instead of hiding the fact that the official one might not be trustworthy.
filed under
references
- [1]How Pixar recovered Toy Story 2 after a Unix command deleted nearly the entire film in 1998TechSpot, 2025techspot.com
- [2]How Pixar Accidentally Deleted (& Recovered) Toy Story 2ScreenRant, 2024screenrant.com