Repairing after "mv /* ../"

Question

After leaving my laptop with an open root shell on my desk (running ubuntu 13.10), some not so nice person bricked my system using "mv /* ../"

Is there any easy way to fix this or am I better off saving what can be saved and reformatting?

Answer 1

Now, I'm no expert on commands, but that seems to be a nasty one (why would you leave an open machine in root user anyway?).

If the files are still on the system (not likely) you should be able to just move them back. But since you are asking this I don't think they are.

My best bet, would be to reinstall the system.

And tell yourself never to leave an oen ROOT system again. :P

Answer 2

In most cases, it is actually relatively easy to undo a wrong move. The command mv /* ../ moves every non-hidden file at your top-level directory to the parent of your current working directory.

If you were logged in as root, then your current working directory is /root by default. In that case, the command mv /* ../ does not have any effect as it is effectively translated to mv /* /.

Since you mentioned that "your system is bricked", I assume that you were unlucky and your current directory is not /root (or anything with the parent directory /). Let's say that you were in the directory /var/www. Now, this means that all files were moved to the directory /var/.

Since none of the programs will start (libraries are not accessible, programs are broken too), I suggest to boot into a Live CD and proceed with recovery. In the following commands, replace $ROOT by the mountpoint of your Ubuntu installation (e.g. /media/Ubuntu).

Let's see what is contained in the root directory:

$ ls $ROOT
bin
boot
dev
etc
home
initrd.img    # symlink to /boot/initrd.img-3.8.0-34-generic
lib
lib32
lib64
lost+found    # special directory for ext filesystems, cannot be moved
media
mnt
opt
proc
root
run
sbin
selinux
srv
sys
tmp
usr
var
vmlinuz    # symlink to boot/vmlinuz-3.8.0-34-generic

The glob pattern /* is expanded by the shell, so the command becomes something like:

mv /bin /boot (stripped for saving space) /usr /var /vmlinuz  /var/

If /var/ did not contain any of the names from /, then you could simply move it back. Assuming that your current working directory is /var (cd /var), you can run:

mv bin boot (stripped for saving space) usr var vmlinuz $ROOT/

Or do it one-by-one:

mv bin $ROOT/
mv boot $ROOT/
...
mv var $ROOT/
mv vmlinuz $ROOT/

Special cases:

• When a directory in /var/ has the same name as a directory in /, then the directory is not moved. This is the case for /run/ and /var/run/.

Special cases that are not applicable here, but mentioned for completeness:

• When a directory in /var/ has the same name as an item in / (directory, files, symlinks, etc.), then the item from / will be moved into the directory of /var/NAME. For example, if /NAME is a file or directory and /var/NAME/ is a directory, then /NAME will be moved to /var/NAME/NAME.
• When /var/NAME is a file and /NAME is a file too, then /var/NAME is overwritten with /NAME. Recovery is not so easy here as you need forensics tools now.
• When /var/NAME is a file and /NAME is a directory, then nothing will happen (and an error message is printed).

---

Next time do not forget to lock your screen (Ctrl + Alt + L) and hint the "not so nice guy" that data loss is not a nice New Year present ;-)

Answer 3

This will depend on which directory your root shell was left open in. The command mv /* ../ will move everything from the / folder to the parent folder of your current directory.

Now, the main issue you will have is that no commands will work since /bin will now be /home/bin (assuming your root shell's working directory was your $HOME). This can easily be solved by booting into a live session, mounting your local drive and moving the files back.

You can also try running /home/bin/ls /home. If that shows you folders like /usr and /etc, you know that your / files have been moved to /home` and you can get them back by running (from the open root shell):

/home/bin/mv /home/{bin,boot,dev,etc,lib,lib32,lib64,media,mnt,opt,proc,root,run,sbin,srv,sys,tmp,usr,var} /