Restore from lost+found

Question

There was a problem on an EXT4 FS/memorycard and after and fsck all the files were put in the lost+found.

Question: how can I restore the old filename/hierarchy from the lost+found? Or it is impossible? Not counting a restore from backup.

Answer 1

You can't find the original name and location of a file in /lost+found because that's what lost+found is about: it's where fsck puts fragments of files that it hasn't been able to attach anywhere in the directory tree. If the location was known, fsck would have left the file where it was meant to be.

It's theoretically possible that fsck could have only partial information, such as the file name but not the directory location, but that doesn't happen with typical filesystem.

You may be able to find clues in the file itself. The file command will at least tell you what kind of file it is (if it recognizes it). Some files carry additional information inside; for example JPEG and TIFF images may contain EXIF data, MP3 files may contain ID3 tags, etc.

Answer 2

Last time I had to do that - many years ago - you had to guess based on file content. I doubt there is a better way today.

The 'file' program can help here since it will give you an idea of the type of data, so you can use this to view the files appropriately for a start.

Answer 3

In my case there was I/O error during reading. And after run of e2fsck I've found most of my files in lost+found in subfolders, and most files (and filenames) was ok.

So go to lost+found, run

find | less

and see if you will find your files. Good luck!

Answer 4

The real answer is that you shouldn't try. You have no idea if the contents are complete. You should restore from a known good copy.

Answer 5

File names and hierarchy no, but using file can help you recover some stuff. I use the Joe editor which has rectangular selections if you enable them. So I could do "ls > ques" then search-replace to turn it into a list of statements like 'file "#133024" > 133024.txt'. I ran that as an sh script, then I could do 'grep PDF *.txt > pdflist'. With that open in an mc viewer and another mc in another terminal I looked through pdflist.txt and moved all the PDFs into their own directory. You can do the same with ASCII text files and whatever else it identifies.

There are also the odd surprises like '#410423: gzip compressed data, was "x264_git.tar"'. You can also 'cat *.txt > filelist' to get the descriptions all in one file.