How to recover files from lost+found after fsck in linux (How I did it in Ubuntu)

Yesterday, My Ubuntu 10.04 was not able to boot, displaying “Continue to wait; Press S to skip mounting or M for manual recovery” due to file system error in / and /home partitions. I went ahead with Recovery boot option and run fsck on both / and /home file systems. / was OK. Then I had problem in getting fsck cleared for /home. Then I was forced to use “fsck -p /home” (automatic fixing) and “fsck -y /home” (select yes for all prompts automatically). After these run, /home passed fsck successfully. But the real stuff showed its face when I mount /home. None of my user files were there /home excpet lost+found directory. I had 5 user home directory for myself and my family members. None of them found. Here is how I recovered them. Yesterday only I thought of writing a post on fsck commands and data recovery in linux, Oh, God! You have made me to experience immediately with my live data :-) Enough, let us go to steps which I followed.

1. At this step, /home file system passed fsck in Ubuntu recovery shell. I have mounted it on /home. I found that my file system used space remains same as that of before crash. It gives some hope of recovering. I run “df -h” command to know this.

2. In lost+found folder I find more than 10000 folders with its name as some random number prefixed with # symbol. fsck has moved my files here in this structure while running. Now my job is to identify the right directory and files and move them out of lost+found. So I run “file *” in lost+found to know the type of files. It lists some thing like,

#7479417:  directory
#7479418:  directory
#7479419:  directory
#7602560:  directory
#7603310:  MPEG sequence, v2, program multiplex
#7603464:  JPEG image data, JFIF standard 1.02
#7603542:  Audio file with ID3 version 2.3.0, contains: Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 320 kbps, 44.1 kHz, JntStereo
#7604043:  ISO 9660 CD-ROM filesystem data 'Linux Mint 9 Isadora           ' (bootable)
#7604089:  ISO 9660 CD-ROM filesystem data 'netbook-x86_64-201005242312    ' (bootable)
#7605425:  MPEG sequence, v2, program multiplex
#7605470:  MPEG sequence, v2, program multiplex
#7605484:  MPEG sequence, v2, program multiplex
#7607478:  gzip compressed data, from Unix, last modified: Fri May 14 07:55:35 2010
#7607788:  gzip compressed data, from Unix, last modified: Tue May  4 14:16:31 2010
#7610801:  PDF document, version 1.4
#7612061:  ISO 9660 CD-ROM filesystem data 'Ubuntu 10.04 LTS amd64         ' (bootable)
#7613228:  directory
#7613583:  directory
#7613588:  directory

3. Then I filtered out all files except “directory” using “file * | grep directory > /root/list.dir” command.

4. Edited /root/list.dir to make it as script to show the list of files in each directory with directory name. Here is a snippet of my script.

set -v
ls -l \#10104455
ls -l \#10104531
ls -l \#10104536

The “set -v” will help you to echo the command the shell execute. “chmod +x list.dir” to make it executable.

5. Now run the script in /home/lost+found folder, redirecting the output to /tmp/ (“./list.dir 1> /tmp/dir.out 2>&1“). Now search for your known file in dir.out output file. I searched for “Desktop” and found some thing like this..

ls -l \#7733249
total 5704
drwxr-xr-x 2 1002 1002    4096 2010-06-05 13:24 Desktop
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Documents
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Downloads
-rw-r--r-- 1 1002 1002     179 2010-04-30 09:14 examples.desktop
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Music
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Pictures
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Public
-rw-r--r-- 1 1002 1002 5794003 2010-05-15 11:00 scrap001_a.ora
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Templates
-rw-r--r-- 1 1002 1002    1265 2010-05-20 14:35 tinda chuteny
drwxrwxr-x 2 1002 1002    4096 2010-05-23 14:57 Ubuntu One
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Videos

6. So, my home directory is #7733249. I moved this folder out of lost+found and rename it as it was.

7. I checked the size of my home directory, it was same as pre-crash period approx. I did some manual verification of files and managed to find a few missing. I can do the above exercise further in lost+found and identify any missing files :-)

Update: I have found the missing files easily using the above method. Now I have got complete data back :-)

Depending on the type of error fsck fixed, there are chances of getting the data back, you may also have good chances of getting it. Please share your comments and experience on this.

Share this post



  • Thank you for this post. It’s very useful. Thank Sisayie and Ptg for their trick. I got some error when run Mark K Cowan’s script so this is my solution.
    #file * | grep directory > /mnt/listing
    #sed -e ‘s/:.*//’ /mnt/listing > /mnt/listing .new
    #sed -e ‘s/^/ls -l \\/’ /mnt/listing .new > /mnt/listingfull
    #bash -x listingfull > listingfulldetail 2>&1

  • Pingback: Recover Lost Files Linux Ubuntu

  • I was just recovering my hard drive,found 3 drives but except one
    I tried Testdisk in Backbox,found a drive which was ext4 and I changed the format of it to NTFS,then after reboot I saw one of my drives which I’ve found while recovering damaged and dived into two drives and I couldn’t mount them
    then I tried to run fsck,after reboot the dived recovered but none of my files exists and just there was lost+found folder.
    I have many personal file in that drive,I tried this article,I was unable o run script
    what should I do?:(plzzz help me

  • Very good! I was able to recover my /home. Now to determine what I did to destroy my file system. Thanks for the tip!

  • Hi,
    Black dog’ hack looks handy.
    I have an ext2 partition full of data used on my android, with all its content into Lost+Found. nothing’s lost if believe df -m.
    Now, using ‘file …*’ showed 3 directories, android app only not the data one.
    Therefore I coudn’t go further. Dunno what “intelligent” (cough cough) step I may have done, argh :/

    @Sisayie and @Ptg Thanks you for the sed simplifying commands.
    Well actually both ended quickly in this location :

    sed: -e expression n°1, caractère 1: commande inconnue: `â’

    Maybe someone knows how to make these two commands work with non ASCII file names.

  • Here’s the whole process as a short script, which runs on filesystem /dev/sd?? and outputs to /tmp/listing:

    fsck -y /dev/sd??
    mkdir /tmp/recover
    mount /dev/sd?? /tmp/recover -o rw
    cd /tmp/recover-lost+found
    echo ‘set -v’
    file * | grep directory 2>/dev/null | perl -pe ‘s/^(\#[0-9]+)\:.*$/ls -l ‘”‘”‘$1′”‘”‘/’
    ) | sh > /tmp/listing


  • I am getiing “202 vmware-9.log entry no 22 doesn’t exist” errors in fsck logs. those files have been moved to lost and found and got renamed. is there a way I can link them using those numbers in fsck logs?

  • Do you know of a good way to batch “file *”? I have thousands of inode pointers. Right now I’m running “file \#1*” and incrementing the number so I don’t run out of file buffers.

  • Hi

    I am stuck from Step 4 onwards. Can you please elaborate? I’d really appreciate it.

  • Your problem was in that that you have run wrong fsck :)

    When you run fsck only it usually run as fsck.ext2 and that is why it have marked all your files as invalid and moved them to the lost+found.
    Next time when you run fsck command remember to do it as fsck.ext3 for ext3 and fsck.ext4 for ext4. I assume you have ext4 filesystem on ubuntu so you should have used fsck.ext4 :)

    Also if you would have a bad disk that has made corruption of your data you could not then succeed in restoring data on same partition, you would get errors and you couldn’t restore.

  • Thanks for this blog. This itself has helped me to identify my data in lost+found. Very good information.
    God bless

  • What kind of script is this and how do I make it work? I’m only familiar with bash.

  • I came across this, while searching for recovering files from lost+found
    It is in rescue mode.. i did fsck on / partition and all is gone… to lost+found

    file *
    there is no such command
    any idea for recovering

    • Use some form of live bootable image, or in rescue mode (I don’t see how you’re in rescue if / is gone, but continuing…) you can go to lost+found and “ls -a /* 2>/dev/null | grep bin | grep -w file”, this will hopefully allow you to find and run file by typing in the absolute file path.
      Best of luck,

    • Use a live CD.

  • For me it’s special now! i have red hat 4 on my machine ; on the beginnig i had du and df which showing different result by handling that issue i typed fsck command / then root directory become apparently free of use and all files from different directories became apperently empty after that i tried to restart the machine by thinking that it will be fixed after reboot it and hang at this stage:

    Minimal BASH-like line editing is supported. For the first word, TAB lists possible command completions. Anywhere else TAB lists the possible completions of a device/file name.

    grub> root (hd0,1)
    Filesystem type is ext2fs, partition type 0×83
    grub> setup (hd0)
    Checking if “/boot/grub/stage1? exists… no

  • Huge thanks for this!

  • Life saver! Thanks for posting this. I did the typical “take care of everyone else’s stuff, forget about your own” and I didn’t have a backup in place. Thought I was HOOPED. This little tut seriously saved my hide.

  • Pingback: fix disk errors ubuntu « onthou

  • Thanks a lot for this article.
    Saved my day!

  • hi iam useing rhel 4 when i editing some santhosh file not saved the system is automatic rebooted hoe to recover santhosh file

  • You can automate appending “ls -l ” in each line as follows

    sed -e ‘s/^/ls -l \/’ file >

    It saves your time significantly.

  • Thanks. It saved my life.

  • Thanks for this article mate, saved a lot of my data using ideas from here! My scripts and tinkering was a bit different but this article helped a lot!

    One suggestion, i used “ls -al” instead to get the hidden files showing too.

    Thank you!

  • I ran across this blog after hours on the net and am thankfully getting back on track. One thing I found useful was to “find >/tmp/find_dump.dir” this shows you a bit more of the structure on the lost+found. I am still working on restoring data, but I figured this may come in handy.

  • does it work for solaris also.

    • I haven’t tried it in Solaris. But the same concept you can apply there. There may be some specific format of files dumped in lost+found incase of other file systems in Solaris.

  • I’ve used your input after a ddrescue session (failing hard drive). Unfortunately it was a data drive with a lot of pictures and I didn’t have it that easy. Still, better than a significant part of my digital life vanishing in oblivion…

  • mmkay so I spent the last 10 mins looking for the same theme you’re using and cannot find it. Didn’t want to have to ask but really would like to use it for my blog, could you let me know? I’ll look back here soon for any replies. Thanks

  • Very Good response & technical input to restore teh data from Lost+found to Normal mode…

    Thank you…


Leave a Reply

Your email address will not be published. Required fields are marked *