Can you have multiple lost and found directories?

Question

I was unaware of the mklost+found command until I read this question.

The mklost+found command will make a new lost+found directory in the pwd.

1. Why would you ever need to run this command? The lost+found directory already exists in / on every distro I've checked.

2. What would happen if you have multiple lost and found directories? Would recovered data fragments go to the lost+found dir in / , or would it go to the most recently created lost+found dir?

I'm not sure how I could deliberately create a data fragment to test this.

Answer 1

Why would you ever need to run this command?

In case the lost+found directory doesn't exist. Since it's just an ordinary directory, the root user can remove it using rm -r. Some versions of fsck, when they need to make use of a lost+found directory, will create it if it doesn't exist, and some versions won't. If there's no lost+found directory, fsck can't recover orphaned files, that is, files that do not have any directory entries that refer to them.

The Linux version of mklost+found has the following feature (from the mklost+found man page):

mklost+found pre-allocates disk blocks to the lost+found directory so that when e2fsck(8) is being run to recover a filesystem, it does not need to allocate blocks in the filesystem to store a large number of unlinked files. This ensures that e2fsck will not have to allocate data blocks in the filesystem during recovery.

This means that, if you have to recover files from a damaged filesystem using fsck, fewer files will be lost as part of the recovery process because fsck won't need to allocate blocks from the filesystem; such blocks which may contain valid file data.

What would happen if you have multiple lost and found directories?

For a given filesystem, fsck will only use one lost+found directory: the one that is at the filesystem's root directory. Any other lost+found directory will not be treated specially.

Answer 2

Q1. Why would you ever need to run this command? The lost+found directory already exists in / on every distro I've checked.

Something needs to create the lost+found, this command would appear to do that. Every medium you mount needs to maintain its own lost+found.

excerpt from man page

mklost+found is used to create a lost+found directory in the current working directory on a Linux second extended file system. There is normally a lost+found directory in the root directory of each filesystem.

What's the big deal with making a lost+found directory?

mklost+found pre-allocates disk blocks to the lost+found directory so that when e2fsck(8) is being run to recover a filesystem, it does not need to allocate blocks in the filesystem to store a large number of unlinked files. This ensures that e2fsck will not have to allocate data blocks in the filesystem during recovery.

Q2. What would happen if you have multiple lost and found directories? Would recovered data fragments go to the lost+found dir in / , or would it go to the most recently created lost+found dir?

I would expect that the last one would be the one that gets used by e2fsck if it needs to move data blocks to lost+found.

Answer 3

"The lost+found directory already exists in / on every distro I've checked."

But that's not the point. Every "real" filesystem (which maps to a block storage of some sort, as opposed to pseudo filesystems like /proc and swap) needs a lost+found orphanage. For example, if you have a separate filesystem for /home, then there should be /home/lost+found. This is because fsck won't move a file to /lost+found on the root filesystem; it leaves the files it finds where it found them, but creates a directory entry in the orphanage so that a human can intervene to arrange for the appropriate adoption. Knowing that something is in /home/lost+found vs. /var/lost+found can make that manual intervention far easier.

Answer 4

According to Essential System Administration

Disk errors or incorrect system shutdown may cause files to become lost: lost files refer to disk locations that are marked as in use in the data structures on the disk, but that are not listed in any directory (e.g., a non-empty in ode that isn't listed in any directory). When the system is booting, it runs a program called fsck that, among other things, finds these files. There is a lost+found directory on every disk partition; /lost+found is the one on the root disk.

Most likely utilities such as fsck look put the file fragments in the lost+found directory inside the root of the respective partition. Other lost+found directories should be ignored.