How to Restore files from lost+found

How to Restore files from lost+found: The folder entitled /lost+found is where fsck puts fragments of files that it hasn’t been able to attach anywhere in the directory tree. The lost+found directory (not Lost+Found) is a construct used by fsck when there is damage to the filesystem. Files that would normally be lost because of directory corruption would be linked in that filesystem’s lost+found directory by inode number.

/lost+found is an important directory which is useful for recovering files which are not properly closed due to many reasons such as power failure. Lost+Found is created by the system at the time of Linux OS installation for each partition we create. In other words, we can say the mounted folder contains this lost+found folder. This folder contains the files with no links and files to be recovered. Any file to be recovered is kept in this folder. fsck command is used to recover these files.

How to Restore files from lost+found

1.If you are unable to boot and seeing the screen “Continue to wait; Press S to skip mounting or M for manual recovery” due to file system error in / and /home partitions. Then select the recovery option.

2.Run fsck on both / and /home file systems.

3.If you are having trouble in getting fsck cleared for /home then use:

 fsck -p /home (Automatic fixing)
"fsck -y /home" (this would select yes for all the prompts automatically).

4.Now you would be able to pass /home from fsck successfully.

5.If you will try mount /home there won’t be any user files excpet lost+found directory. Run “df -h” and you will see that your file system will be using the same space as before the crash because all the files are in the lost+found directory and we are going to recover them.

6.Now in the lost+found folder, you will see that there are a large number of folders without a name and scrutinizing each one will waste so much of your time. So next we should run “file *” to know which type of file we are dealing with.

#7479417: directory
#7479418: directory
#7479419: directory
#7602560: directory
#7603310: MPEG sequence, v2, program multiplex
#7603464: JPEG image data, JFIF standard 1.02
#7603542: Audio file with ID3 version 2.3.0, contains: Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 320 kbps, 44.1 kHz, JntStereo
#7604043: ISO 9660 CD-ROM filesystem data 'Linux Mint 9 Isadora ' (bootable)
#7604089: ISO 9660 CD-ROM filesystem data 'netbook-x86_64-201005242312 ' (bootable)
#7605425: MPEG sequence, v2, program multiplex
#7605470: MPEG sequence, v2, program multiplex
#7605484: MPEG sequence, v2, program multiplex
#7607478: gzip compressed data, from Unix, last modified: Fri May 14 07:55:35 2017
#7607788: gzip compressed data, from Unix, last modified: Tue May 4 14:16:31 2017
#7610801: PDF document, version 1.4
#7612061: ISO 9660 CD-ROM filesystem data 'Ubuntu 10.04 LTS amd64 ' (bootable)
#7613228: directory
#7613583: directory
#7613588: directory

7.Now let’s filter out the result because we just want the directory to be included in our result. So run “file * | grep directory > /root/list.dir” command.

8.Next, edit /root/list.dir to make it a script to show the list of files in each directory. Edit the file to make it a script using vi, vim, nano. Add set -v to the first line and add ‘ls -l‘ to the beginning of every other line.

set -v
ls -l #10104455
ls -l #10104531
ls -l #10104536

9.Now make the file executable then run it and redirect the output to a file:

chmod -x /tmp/list.dir
./list.dir 1> /tmp/list.out 2>&1

10.Now search for the file e.g. Desktop in the dir.out output file. The result will be something like this:

ls -l #7733249
total 5704
drwxr-xr-x 2 1002 1002 4096 2017-06-05 13:24 Desktop
drwxr-xr-x 2 1002 1002 4096 2017-04-30 09:15 Documents
drwxr-xr-x 2 1002 1002 4096 2017-04-30 09:15 Downloads
-rw-r--r-- 1 1002 1002 179 2017-04-30 09:14 examples.desktop
drwxr-xr-x 2 1002 1002 4096 2017-04-30 09:15 Music
drwxr-xr-x 2 1002 1002 4096 2017-04-30 09:15 Pictures
drwxr-xr-x 2 1002 1002 4096 2017-04-30 09:15 Public
-rw-r--r-- 1 1002 1002 5794003 2017-05-15 11:00 scrap001_a.ora
drwxr-xr-x 2 1002 1002 4096 2017-04-30 09:15 Templates
-rw-r--r-- 1 1002 1002 1265 2017-05-20 14:35 tinda chuteny
drwxrwxr-x 2 1002 1002 4096 2017-05-23 14:57 Ubuntu One
drwxr-xr-x 2 1002 1002 4096 2017-04-30 09:15 Videos

11.The above output specified that the home directory is #7733249. Now to restore the home folder just mv the folder:

mv /lost+found/#7733249 /home/yourUsername

Note: Replace your username with the actual username of your Linux installation.

Method 2: Use the script to automatically recover files

First, run “sudo -i” or a “sudo su –” and then run the below script which runs on filesystem /dev/sd?? and outputs to /tmp/listing:

fsck -y /dev/sd??
mkdir /tmp/recover
mount /dev/sd?? /tmp/recover -o rw
cd /tmp/recover-lost+found
(
echo ‘set -v’
file * | grep directory 2>/dev/null | perl -pe ‘s/^(#[0-9]+):.*$/ls -l ‘”‘”‘$1'”‘”‘/’
) | sh > /tmp/listing

That’s it you have successfully learned How to Restore files from lost+found but if you still have any question regarding this article feel free to ask them in the comment’s section.