#272 1998 · Pixar · Film production / technology operations
After a stray command erased 90% of Toy Story 2, Pixar's leadership decided the one thing not worth finding out was who typed it
the problem
A catastrophic technical failure created enormous pressure to identify and hold someone accountable
background
During production of Toy Story 2 in 1998, a Unix delete command run from the wrong directory propagated across Pixar's network and erased roughly 90% of the film's files — character models, sets, animation, two years of work — in minutes. When the recovery team reached for the studio's own backup system, built specifically to prevent exactly this scenario, they found it had been silently failing for about a month; the safety net meant to catch this failure had itself failed unnoticed.
The instinctive organizational response to a disaster this expensive is to find out who caused it — whoever typed the command becomes the person a studio under enormous financial and schedule pressure needs to hold accountable, both to satisfy leadership above and to feel like the problem has been addressed. Pixar had that same pressure and the same easy target available.
what everyone would do
Find and hold accountable whoever ran the destructive command — the instinctive response to a catastrophic failure under enormous financial and schedule pressure, and the move that satisfies leadership's need to feel the problem has been addressed. It fails because punishing the person who happened to trigger a failure that a properly working safeguard should have contained does nothing to fix the actual cause: a backup system that had been silently broken for a month with nobody noticing.
what they saw
Catmull saw that finding a person to blame would have solved the wrong problem — the real failure was systemic (a backup that had quietly stopped working) and organizationally invisible (nobody had a reason to check it until disaster struck). He recognized that the same blame-seeking instinct that feels like accountability is exactly what teaches people to hide the informal workarounds and near-misses that would otherwise surface a broken system before it costs you everything.
the move
The film was ultimately recoverable only because supervising technical director Galyn Susman, working partly from home after having a baby, had been keeping her own informal, unauthorized copy of the production files on her home computer — colleagues drove to retrieve the machine and used it to rebuild the lost work. In the aftermath, co-founder Ed Catmull explicitly ruled blame-finding out of the recovery process: by his own account, Pixar 'never sought out who was responsible,' reasoning that identifying and punishing the individual wouldn't help anyone learn from the failure, and instead prioritized restoring the film, then fixing the backup system, then adding safeguards against a repeat.
why it works
Not seeking out who ran the command removed the incentive for anyone involved to conceal information during the recovery, which mattered directly: the film was only recoverable because Galyn Susman had been quietly keeping an unauthorized personal backup, a deviation from official process she had no reason to hide or destroy evidence of because Pixar's culture didn't punish that kind of quiet self-protection. Focusing the response on fixing the system — rebuilding backup infrastructure with automated testing, distributed storage, and restrictions on destructive commands — addressed the actual point of failure directly, rather than removing one individual and leaving the same broken safeguard in place for the next person to accidentally trigger.
the payoff
Toy Story 2 was fully recovered and delivered on its original schedule; the studio rebuilt its backup infrastructure with automated testing, distributed storage, and access restrictions on destructive commands rather than around any single person's conduct.
where it breaks
A blameless response only produces better outcomes if it's paired with genuine structural fixes — treating a failure as systemic while changing nothing about the system just removes accountability without removing risk, and repeat failures under a purely blameless culture erode trust in the approach itself. It also depends on the failure actually being systemic rather than a matter of individual negligence, malice, or a clear, avoidable violation of a known safety procedure; extending blamelessness to cases of genuine misconduct removes a deterrent that sometimes is doing real work, and conflating the two undermines the credibility of blameless review for the cases where it actually helps.
what came after
Catmull's account of the incident in his book Creativity, Inc. became a widely cited case for blameless post-incident review, now standard doctrine in software engineering and operations culture (the same principle behind modern blameless postmortems), and is frequently pointed to as the reason Susman's informal backup existed in the first place — a culture that doesn't punish deviation from official process is the same culture where someone quietly keeps a personal safety net instead of hiding the fact that the official one might not be trustworthy.
references
- [1]How Pixar recovered Toy Story 2 after a Unix command deleted nearly the entire film in 1998TechSpot, 2025techspot.com
- [2]How Pixar Accidentally Deleted (& Recovered) Toy Story 2ScreenRant, 2024screenrant.com