Purpose of the lost+found folder:
- This directory is for recovering files which are not properly closed due to many reason such as power failure.
- The lost+found folder contains the files with no links and files to be recovered.
- Any file to be recovered is kept in this folder. fsck command (file system check) is used to recover these files.
- In generally, the directory is empty; but if there is corruption, the conditions files can be recovered after fsck places them here.
- The lost+found directory (not Lost+Found) is a construct used by fsck when there is damage to the filesystem (not to the hardware device, but to the fs).
- Files that would normally be lost because of directory corruption would be linked in that filesystem’s lost+found directory by inode number.
- If you lost directories or lost files or even lost devices. Each filesystem should have its own lost+found directory, but you influence be looking at a system with only one file system.
- If you run fsck, the filesystem check and repair command, it find the data fragments that are not referenced anywhere in the filesystem. In particular, fsck might find data that looks like a complete file but doesn’t have a name on the system — an inode with no corresponding file name. This data is still using up space, but it isn’t accessible by any normal means.
- The fsck to repair the filesystem, it will back the deleted files into files. The device is, the file had a name and location once, but that information is no longer available. So fsck deposits the file in a specific directory, called lost+found (after lost and found property).
- Files that appear in lost+found are typically files that were already unlinked (i.e. their name had been erased) but still opened by some process (so the data wasn’t erased yet) when the system halted suddenly (kernel panic or power failure). If that’s all that happened, these files were slated for deletion anyway.
- Files can also appear in lost+found because the filesystem was in an inconsistent state due to a software or hardware bug. If that’s the case, it’s a way for you to find files that were lost but that the system repair managed to salvage. If they do they may be incomplete or out of date; it all depends how bad the filesystem damage was.
- On many filesystems, the lost+found directory is a bit special because it preallocates a bit of space for fsck to deposit files there. (The space isn’t for the file data, which fsck leaves in place; it’s for the directory entries which fsck has to make up.) If you accidentally delete lost+found, don’t re-create it with mkdir, use mklost+found .
- In lost+found folder you find more than 10000 folders with its name as some random number prefixed with # symbol. fsck has moved my files here in this structure while running .And ,you to identify the right directory and files and move them out of lost+found. So you run “file *” in lost+found to know the type of files. It lists some thing like
- Then you filtered out all files except “directory” using “file * | grep directory > /root/list.dir” command.
- Edited /root/list.dir to make it as script to show the list of files in each directory with directory name. Here is a snippet of my script.
- The “set -v” will help you to echo the command the shell execute. “chmod +x list.dir” to make it executable.
- Now run the script in /home/lost+found folder, redirecting the output to /tmp/ (“./list.dir 1> /tmp/dir.out 2>&1“). Now search for your known file in dir.out output file. Now searched for “Desktop” and found some thing like this..