25

I tried to figure this out on my own. Here's the command I used in the terminal:

find . -name "*.jpg" -exec mv {} pictures \;

I did not create a directory named pictures first. What happened was a file named pictures.gif was created. Did it find the files then overwrite them as it moved them?

What is this pictures.gif file that has been created as a result of this command?

Are the files still possibly on the drive somewhere?

3
  • Sorry that happened to you and I hope you can recover stuff. Mystified by the .gif - would be interesting to know what happened there.
    – SEngstrom
    May 10, 2013 at 2:41
  • 7
    If you're writing the name of a directory, append / to it! Always! Then it can only ever be a directory. May 10, 2013 at 7:22
  • 2
    Like the top answer says : stop using that drive now, and attempt to recover the deleted .jpg files. For this, however, I'd rather recommend the open-source and cross-platform PhotoRec, which knows many image formats (Jpg, but also different raw files, etc) and is very thorough. May 10, 2013 at 7:49

2 Answers 2

44

First: stop using this drive now. It's ok to remount it read-only, just make sure not to do any more writing. Yes, you've deleted the pictures. They may be recoverable, but the more you keep using that drive, the less chance you have to recover anything.

Your command ran mv pic1.jpg pictures, mv pic2.jpg pictures, etc. Each invocation of mv overwrote the file currently named pictures by another picture.

Moving a file (within the same filesystem) means detaching it from the directory that contains it and attaching it to the target directory under the new name. So no file data was modified or deleted by this command, only the directory entries for the images that have disappeared.

You can run a tool that scours your filesystem's free space and looks for things that look like jpegs. Fortunately, every jpeg file starts with a recognizable header. Tools that look for deleted content are called carving tools. There are a few in Ubuntu, including recoverjpeg, foremost, testdisk, … If the photos are on a separate home partition or on an external drive, install one or more of those packages and point them to the partition with the deleted pictures.

If the photos are on your system disk, you need to stop using your system immediately. Use another computer to download a live CD or USB and boot from that. Any of the live CDs that include testdisk should fit the bill, but some are easier to use than others. System Rescue CD is a good general-purpose system rescue CD. Ubuntu Rescue Remix may be more familiar for an Ubuntu user.


For future reference, get into the habit of using mv -i unless you aim to overwrite files. You may already have an alias for mv, but that only kicks in when you type mv directly on the command line, not when mv is invoked by a script or by the find command.

$ : >pictures
$ mv -i foo.jpg pictures
mv: overwrite `pictures'?

Also, if you put a / after a name that is supposed to be the name of a directory, you'll get an error if the directory doesn't exist, or if there is a file by that name which isn't a directory.

$ : >pictures
$ mv foo.jpg pictures/
mv: cannot move `foo.jpg' to `pictures/': Not a directory
$ rm pictures
$ mv foo.jpg pictures/
mv: cannot move `foo.jpg' to `pictures/': Not a directory

To avoid the pitfalls of find, you could use bash's recursive directory traversal feature instead. You need to turn it on first with the command shopt -s globstar (you can add this line to your ~/.bashrc. Then:

mv **/*.jpg pictures/

(Note that in bash, **/ also traverses symbolic links to directories, and there's no way to turn this off. If you want a recursive traversal that doesn't look through symbolic links to directories, use zsh or find.)

2
  • 1
    Did you omit the / after pictures in the second set of examples? I.e., shouldn't it be mv foo.jpg pictures/ (with the /) in both mv commands? May 14, 2013 at 9:58
  • @PaddyLandau Indeed, this was a really bad copy-paste or edit failure. Thanks for the report. May 14, 2013 at 16:27
13

I am afraid that you have just lost all your pictures into that single file. It is possible to recover some files using forensic tools like foremost, but the success rate drops the longer you use the media (disk). (to be precise, the longer the partition is mounted.)

Next time, when you mean a directory, add a slash to it and add the -i option to ask for confirmation in case a file already exists:

find -name "*.jpg" -exec mv -i {} pictures/ {} \;
2
  • 6
    Yeah I have to re-emphasise: GET INTO A LIVE CD ENVIRONMENT IMMEDIATELY! If you want these files back you need to stop using the drive now. And if you need to download and burn an image, do it from another computer. The less activity that happens on this disk, the better chance your photos have of being restored.
    – Oli
    May 9, 2013 at 21:27
  • Thanks for this. I saw your answer first and immediately pulled the plug on the machine and rebooted with my multiboot usb rescue disk.
    – jtnewhou
    May 11, 2013 at 5:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .