lost+found directory

[Shivkumar]

what are the significance of lost+found directory ? Will fsck command pick up files from here in case of lost files from a file system because of detached i-nodes ?

[James R. Ferguson · Accepted solution]

Hi Shiv:

You are correct. One use of the 'lost+found' directory is by 'fsck' to place files (or fragments thereof) that cannot be otherwise recovered.

Another use is by Online JFS. A file named '.fsadm' is written to this directory to serve as a lock for JFS processes like defragmention and file resizes.

Regards!

...JRF...

[Deoncia Grayson_1]

lost+found directory:

files located there are usually created by the fsck command. The files that have no valid links are copied into this directory

[A. Clay Stephenson]

No, fsck puts the orphaned files into the lost+found directory. It is then up to ypu to figure what these files are. The other use for lost+found in vxfs filesystems is that it the lock file .fsadm is stored there.

[Steven E. Protter]

Shalom Shiv,

If you ever see a file in there it means something bad has happened.

fsck will probably not recover them. Believe it or not, I've never seen a file there in 10 years. If I found one, I'd look at it and figure out if its useful and move it out of there.

You do mention one of the probable causes.

SEP

[Raj D.]

Hi Shiv ,


When files are recovered after any sort of problem or failure,they are placed in the lost+found directory, if the kernel cannot ascertain the proper location in the system.
I dont think fsck can recover those files, but we can check and try to figure it out, if we need to move them and can use in the proper place.

Cheers,
Raj.

[Bill Hassell]

Most of the entries in lost+found are inodes that have become disconnected from the directory. This is more common in HFS filesystems that are very busy when the system crashes, of when the fs_async kernel parameter is enabled and the system crashes. What happens is that updated information for the directory is not completely written when the system is halted by a crash or power fail. The inodes still exist but there is no reference to them in the directory. So the file (may also be another directory) is reconnected by fsck to the directory structure by giving the orphaned inode a name which is the inode number. The # character is put in front of the name to flag the file as special.

To see what these files might have been, you use the file command and possibly the strings command, something like this:

file \#123456
strings \#123456 | more

Note the use of \ in front of the # to escape it's special meaning to the shell as a comment. If the file is needed , just rename (mv) the filename. Most of the files I've seen there have been temp files.

[James R. Ferguson]

Hi Shiv:

One additional comment. Normally the lost+found directory is built whenever a filesystem is created. Should you ever remove it, you can recreate it with:

# cd mydirectory
# mklost+found

Have a look at the manpages for more information.

Regards!

...JRF...

[Arunvijai_4]

Hi Shiv,

"lost+found" is created when you try to create a new File system. It is used when you perform a "fsck" on any FS.

If you want to create "lost+found" on your own, you can use "mklost+found "

-Arun

[Sivakumar TS]

Hi,

In the lost+found Directory

When files are recovered after any sort of problem or failure,they are placed in the lost + found directory, if the kernel cannot ascertain the proper location in the system.(no links !)

It is normally poppulated during a fsck after a filesystem corruption.

With Regards,

Siva.

[Arunvijai_4]

Hi Shiv, some links of your interest about "lost+found"

http://www.tldp.org/LDP/Linux-Filesystem-Hierarchy/html/lostfound.html
http://www.isu.edu/departments/comcom/unix/workshop/fstour.html

-Arun

[Devender Khatana]

Hi,

Yes, lost+found is used to put the files which are not closed properly due to improper file system unmount. This can be used to receover files in someway if the you know the contents of the files but this will only be a rare hit.

HTH,
Devender