How to recover files from lost+found after fsck in linux (How I did it in Ubuntu)
Yesterday, My Ubuntu 10.04 was not able to boot, displaying “Continue to wait; Press S to skip mounting or M for manual recovery” due to file system error in / and /home partitions. I went ahead with Recovery boot option and run fsck on both / and /home file systems. / was OK. Then I had problem in getting fsck cleared for /home. Then I was forced to use “fsck -p /home” (automatic fixing) and “fsck -y /home” (select yes for all prompts automatically). After these run, /home passed fsck successfully. But the real stuff showed its face when I mount /home. None of my user files were there /home excpet lost+found directory. I had 5 user home directory for myself and my family members. None of them found. Here is how I recovered them. Yesterday only I thought of writing a post on fsck commands and data recovery in linux, Oh, God! You have made me to experience immediately with my live data 🙂 Enough, let us go to steps which I followed.
1. At this step, /home file system passed fsck in Ubuntu recovery shell. I have mounted it on /home. I found that my file system used space remains same as that of before crash. It gives some hope of recovering. I run “df -h” command to know this.
2. In lost+found folder I find more than 10000 folders with its name as some random number prefixed with # symbol. fsck has moved my files here in this structure while running. Now my job is to identify the right directory and files and move them out of lost+found. So I run “file *” in lost+found to know the type of files. It lists some thing like,
#7479417: directory #7479418: directory #7479419: directory #7602560: directory #7603310: MPEG sequence, v2, program multiplex #7603464: JPEG image data, JFIF standard 1.02 #7603542: Audio file with ID3 version 2.3.0, contains: Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 320 kbps, 44.1 kHz, JntStereo #7604043: ISO 9660 CD-ROM filesystem data 'Linux Mint 9 Isadora ' (bootable) #7604089: ISO 9660 CD-ROM filesystem data 'netbook-x86_64-201005242312 ' (bootable) #7605425: MPEG sequence, v2, program multiplex #7605470: MPEG sequence, v2, program multiplex #7605484: MPEG sequence, v2, program multiplex #7607478: gzip compressed data, from Unix, last modified: Fri May 14 07:55:35 2010 #7607788: gzip compressed data, from Unix, last modified: Tue May 4 14:16:31 2010 #7610801: PDF document, version 1.4 #7612061: ISO 9660 CD-ROM filesystem data 'Ubuntu 10.04 LTS amd64 ' (bootable) #7613228: directory #7613583: directory #7613588: directory
3. Then I filtered out all files except “directory” using “file * | grep directory > /root/list.dir” command.
4. Edited /root/list.dir to make it as script to show the list of files in each directory with directory name. Here is a snippet of my script.
The “set -v” will help you to echo the command the shell execute. “chmod +x list.dir” to make it executable.
5. Now run the script in /home/lost+found folder, redirecting the output to /tmp/ (“./list.dir 1> /tmp/dir.out 2>&1“). Now search for your known file in dir.out output file. I searched for “Desktop” and found some thing like this..
ls -l \#7733249 total 5704 drwxr-xr-x 2 1002 1002 4096 2010-06-05 13:24 Desktop drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Documents drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Downloads -rw-r--r-- 1 1002 1002 179 2010-04-30 09:14 examples.desktop drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Music drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Pictures drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Public -rw-r--r-- 1 1002 1002 5794003 2010-05-15 11:00 scrap001_a.ora drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Templates -rw-r--r-- 1 1002 1002 1265 2010-05-20 14:35 tinda chuteny drwxrwxr-x 2 1002 1002 4096 2010-05-23 14:57 Ubuntu One drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Videos
6. So, my home directory is #7733249. I moved this folder out of lost+found and rename it as it was.
7. I checked the size of my home directory, it was same as pre-crash period approx. I did some manual verification of files and managed to find a few missing. I can do the above exercise further in lost+found and identify any missing files 🙂
Update: I have found the missing files easily using the above method. Now I have got complete data back 🙂
Depending on the type of error fsck fixed, there are chances of getting the data back, you may also have good chances of getting it. Please share your comments and experience on this.