Hi all,

I have experienced a bizarre error, which I didn't know was possible. I'm running ubuntu 18.04 on my laptop, and I used vlc to take a screenshot of a video file. Now I must have messed something up in the file saving dialog, because afterwards I noticed that instead of my 'Pictures' directory in which I intended to save, I had an image file named 'Pictures', which was indeed the screenshot. I can imagine how that worked, but I wasn't aware that it was possible to overwrite a directory with a file.

Anyway, so I lost all my pictures in that directory, some of which weren't backed up. I recovered a lot of files using the brute force approach of running magicrescue on the partition, and I'm now sorting through the mess of files I got out of that. I noticed it too late, so the file system (ext4) was still active and some files are probably lost.

Now I was wondering if there are any better ways of recovering something like this? I played arount with Sleuthkit and ext4undelete, but that only gives me access of deleted files, and these ones weren't deleted.
What exactly happens on a file system level when a directory is overwritten by a file?

We're going to need some more information in order to help you.

First, check all your directories for the directory "Pictures". Sometimes when I think I can't find a file, I find that it is actually listed under another drive, under a name I didn't think it would be called. For instance, "DRIVE E", a USB drive which I use for backups, can appear under "/dev/usb", but it can also be under "/media/len" or "/home/len". Poke around, you might find it in another directory where you had not thought to look.

From the command line, the following command should find the directory named "Pictures" under your Home directory, if it indeed is still there:

find $HOME -type d -name "Pictures"

I ran that command on my machine, and here is a screen print of the results:

find $HOME -type d -name "Pictures"
/home/len/Pictures
/home/len/Church/John Adams/Pictures

On the other hand, you could indeed have a real problem. If you still can't find the file, send us some screenshots of the directories on your system.

Hopefully, you'll find your directory without too much trouble. Otherwise, we can help you piece together a solution.

Searched for it on all drives, and a number of subdirectories and filenames I remembered. All gone. Still going through the files recovered with magicrescue, which includes every icon and image in my browser history of the past few days.

I'm mainly interested in what happens on a file system level: so the newly created image file overwrites the location where the directory is assigned. Is there a possibility to access the files which were assigned to that now deleted directory? Or is the only way the brute force approach magicrescue uses (going over the entire partition looking for signatures of jpeg or png files)?

I did some research into this problem. You ask an interesting question, with a file replacing an entire directory. I'm trying to think of a situation where this would occur, and I'm coming up blank.

However, these links will provide more insight into Linux' methods of moving, copying and deleting files:

https://opensource.com/article/19/8/...es-linux-depth

https://swcarpentry.github.io/shell-novice/03-create/

And, in particular, this:

https://jpsoft.com/help/move.htm

where I saw this quote: "When you move a single file, the destination can be a directory name or a file name. If it is a directory name, and you add a backslash [\] to the end of the name, MOVE will display an error message if the name does not refer to an existing directory. You can use this feature to keep MOVE from treating a mistyped destination directory name as a file name, and attempting to move the source file to that name."

Regarding vlc, I found this link:
https://turbofuture.com/computers/Ho...C-Media-Player

which is vlc in Windows, but I know you are using Ubuntu 18.04. However, that website states the following:

"‘Directory path prefix’ is very important. Remember the folder you opened up earlier? The text in the address bar that you copied goes in this box. Make sure it looks correct; if anything is wrong here, VLC won’t know where to save the screenshots. (I’ve accidentally messed up putting the folder’s location here before, and wasted my time having to run the video file again and actually get my screenshots the second time! Be careful!)"

Also, this link may shed some light:

https://www.vlchelp.com/take-picture-snapshot-video/

I tried to help. I don't use vlc, so I'm just Googling for websites which might be relevant. Maybe you've already seen these links. But these may help explain what vlc did. It seems that being careful to specify the exact destination directory (or NOT specify, so that the default is taken) is crucial.