After leaving my laptop with an open root shell on my desk (running ubuntu 13.10), some not so nice person bricked my system using "mv /* ../"

Is there any easy way to fix this or am I better off saving what can be saved and reformatting?

  • 1
    Can you post the output of ls /? I don't think any changes have been made anyways(/ and ../ are the same).
    – jobin
    Jan 5, 2014 at 14:36

3 Answers 3


Now, I'm no expert on commands, but that seems to be a nasty one (why would you leave an open machine in root user anyway?).

If the files are still on the system (not likely) you should be able to just move them back. But since you are asking this I don't think they are.

My best bet, would be to reinstall the system.

And tell yourself never to leave an oen ROOT system again. :P

  • The / is the root folder, it has no parent. Why do you feel there has been a change serious enough to ask for a reinstall?
    – jobin
    Jan 5, 2014 at 14:39
  • That's what I tought, thanks for the quick reply. Guess I will always log out even if I leave the desk a few minutes to get some coffee :-(
    – James
    Jan 5, 2014 at 14:40
  • 2
    @Jobin Note that the command is mv /* ../, not mv /* /... The latter is a no-op. The former moves every non-hidden file from the root directory to the parent directory relative to the current working directory. If you have just opened a shell, then this is typically /home (for non-root users having a home dir like /home/user/) or / (for the root user at /root/).
    – Lekensteyn
    Jan 5, 2014 at 14:43
  • @Lekensteyn Ah, so the files may actually just be moved to /home/ folder. Then it should be no problem moving them all back. Jan 5, 2014 at 14:52
  • @Lekensteyn: Are you sure mv /* ../ moves files relative to the current directory and not to the absolute path.
    – jobin
    Jan 5, 2014 at 14:53

In most cases, it is actually relatively easy to undo a wrong move. The command mv /* ../ moves every non-hidden file at your top-level directory to the parent of your current working directory.

If you were logged in as root, then your current working directory is /root by default. In that case, the command mv /* ../ does not have any effect as it is effectively translated to mv /* /.

Since you mentioned that "your system is bricked", I assume that you were unlucky and your current directory is not /root (or anything with the parent directory /). Let's say that you were in the directory /var/www. Now, this means that all files were moved to the directory /var/.

Since none of the programs will start (libraries are not accessible, programs are broken too), I suggest to boot into a Live CD and proceed with recovery. In the following commands, replace $ROOT by the mountpoint of your Ubuntu installation (e.g. /media/Ubuntu).

Let's see what is contained in the root directory:

$ ls $ROOT
initrd.img    # symlink to /boot/initrd.img-3.8.0-34-generic
lost+found    # special directory for ext filesystems, cannot be moved
vmlinuz    # symlink to boot/vmlinuz-3.8.0-34-generic

The glob pattern /* is expanded by the shell, so the command becomes something like:

mv /bin /boot (stripped for saving space) /usr /var /vmlinuz  /var/

If /var/ did not contain any of the names from /, then you could simply move it back. Assuming that your current working directory is /var (cd /var), you can run:

mv bin boot (stripped for saving space) usr var vmlinuz $ROOT/

Or do it one-by-one:

mv bin $ROOT/
mv boot $ROOT/
mv var $ROOT/
mv vmlinuz $ROOT/

Special cases:

  • When a directory in /var/ has the same name as a directory in /, then the directory is not moved. This is the case for /run/ and /var/run/.

Special cases that are not applicable here, but mentioned for completeness:

  • When a directory in /var/ has the same name as an item in / (directory, files, symlinks, etc.), then the item from / will be moved into the directory of /var/NAME. For example, if /NAME is a file or directory and /var/NAME/ is a directory, then /NAME will be moved to /var/NAME/NAME.
  • When /var/NAME is a file and /NAME is a file too, then /var/NAME is overwritten with /NAME. Recovery is not so easy here as you need forensics tools now.
  • When /var/NAME is a file and /NAME is a directory, then nothing will happen (and an error message is printed).

Next time do not forget to lock your screen (Ctrl + Alt + L) and hint the "not so nice guy" that data loss is not a nice New Year present ;-)


This will depend on which directory your root shell was left open in. The command mv /* ../ will move everything from the / folder to the parent folder of your current directory.

Now, the main issue you will have is that no commands will work since /bin will now be /home/bin (assuming your root shell's working directory was your $HOME). This can easily be solved by booting into a live session, mounting your local drive and moving the files back.

You can also try running /home/bin/ls /home. If that shows you folders like /usr and /etc, you know that your / files have been moved to /home` and you can get them back by running (from the open root shell):

/home/bin/mv /home/{bin,boot,dev,etc,lib,lib32,lib64,media,mnt,opt,proc,root,run,sbin,srv,sys,tmp,usr,var} /

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.