Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I tried to figure this out on my own. Here's the command I used in the terminal:

find . -name "*.jpg" -exec mv {} pictures \;

I did not create a directory named pictures first. What happened was a file named pictures.gif was created. Did it find the files then overwrite them as it moved them?

What is this pictures.gif file that has been created as a result of this command?

Are the files still possibly on the drive somewhere?

share|improve this question
    
Sorry that happened to you and I hope you can recover stuff. Mystified by the .gif - would be interesting to know what happened there. –  SEngstrom May 10 '13 at 2:41
6  
If you're writing the name of a directory, append / to it! Always! Then it can only ever be a directory. –  Lightness Races in Orbit May 10 '13 at 7:22
2  
Like the top answer says : stop using that drive now, and attempt to recover the deleted .jpg files. For this, however, I'd rather recommend the open-source and cross-platform PhotoRec, which knows many image formats (Jpg, but also different raw files, etc) and is very thorough. –  Olivier Dulac May 10 '13 at 7:49

3 Answers 3

up vote 43 down vote accepted

First: stop using this drive now. It's ok to remount it read-only, just make sure not to do any more writing. Yes, you've deleted the pictures. They may be recoverable, but the more you keep using that drive, the less chance you have to recover anything.

Your command ran mv pic1.jpg pictures, mv pic2.jpg pictures, etc. Each invocation of mv overwrote the file currently named pictures by another picture.

Moving a file (within the same filesystem) means detaching it from the directory that contains it and attaching it to the target directory under the new name. So no file data was modified or deleted by this command, only the directory entries for the images that have disappeared.

You can run a tool that scours your filesystem's free space and looks for things that look like jpegs. Fortunately, every jpeg file starts with a recognizable header. Tools that look for deleted content are called carving tools. There are a few in Ubuntu, including recoverjpeg, foremost, testdisk, … If the photos are on a separate home partition or on an external drive, install one or more of those packages and point them to the partition with the deleted pictures.

If the photos are on your system disk, you need to stop using your system immediately. Use another computer to download a live CD or USB and boot from that. Any of the live CDs that include testdisk should fit the bill, but some are easier to use than others. System Rescue CD is a good general-purpose system rescue CD. Ubuntu Rescue Remix may be more familiar for an Ubuntu user.


For future reference, get into the habit of using mv -i unless you aim to overwrite files. You may already have an alias for mv, but that only kicks in when you type mv directly on the command line, not when mv is invoked by a script or by the find command.

$ : >pictures
$ mv -i foo.jpg pictures
mv: overwrite `pictures'?

Also, if you put a / after a name that is supposed to be the name of a directory, you'll get an error if the directory doesn't exist, or if there is a file by that name which isn't a directory.

$ : >pictures
$ mv foo.jpg pictures/
mv: cannot move `foo.jpg' to `pictures/': Not a directory
$ rm pictures
$ mv foo.jpg pictures/
mv: cannot move `foo.jpg' to `pictures/': Not a directory

To avoid the pitfalls of find, you could use bash's recursive directory traversal feature instead. You need to turn it on first with the command shopt -s globstar (you can add this line to your ~/.bashrc. Then:

mv **/*.jpg pictures/

(Note that in bash, **/ also traverses symbolic links to directories, and there's no way to turn this off. If you want a recursive traversal that doesn't look through symbolic links to directories, use zsh or find.)

share|improve this answer
1  
Did you omit the / after pictures in the second set of examples? I.e., shouldn't it be mv foo.jpg pictures/ (with the /) in both mv commands? –  Paddy Landau May 14 '13 at 9:58
    
@PaddyLandau Indeed, this was a really bad copy-paste or edit failure. Thanks for the report. –  Gilles May 14 '13 at 16:27

I am afraid that you have just lost all your pictures into that single file. It is possible to recover some files using forensic tools like foremost, but the success rate drops the longer you use the media (disk). (to be precise, the longer the partition is mounted.)

Next time, when you mean a directory, add a slash to it and add the -i option to ask for confirmation in case a file already exists:

find -name "*.jpg" -exec mv -i {} pictures/ {} \;
share|improve this answer
5  
Yeah I have to re-emphasise: GET INTO A LIVE CD ENVIRONMENT IMMEDIATELY! If you want these files back you need to stop using the drive now. And if you need to download and burn an image, do it from another computer. The less activity that happens on this disk, the better chance your photos have of being restored. –  Oli May 9 '13 at 21:27
    
Thanks for this. I saw your answer first and immediately pulled the plug on the machine and rebooted with my multiboot usb rescue disk. –  jtnewhou May 11 '13 at 5:11

pictures.gif is a red herring which has nothing to do with that find command.

Yes, the mv command unlinks the existing directory entry. This is done right inside the kernel, by the rename system call.

If you execute

mv foo.jpg pictures
mv bar.jpg pictures

then foo.jpg is gone; and pictures is bar.jpg under a new name.

Hopefully you have copies of your pictures on some SD card.

share|improve this answer
    
The file content is not gone yet but just a directory entry pointing to this content. The content itself will be rewritten as soon as this "empty" disk space will be used for some other file. Other solution here describe it quite well –  Cougar May 10 '13 at 14:27
    
The question doesn't ask for solutions. It asks "are the files still there". The answer is, no they aren't. Not the files, just disk blocks that used to be files. Some of them, anyway. –  Kaz May 10 '13 at 18:45
    
What I actually meant was, is the data still there? Sorry, should have been more clear. –  jtnewhou May 11 '13 at 5:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.