Black God

How to recover files from lost+found after fsck in linux (How I did it in Ubuntu)

Yesterday, My Ubuntu 10.04 was not able to boot, displaying “Continue to wait; Press S to skip mounting or M for manual recovery” due to file system error in / and /home partitions. I went ahead with Recovery boot option and run fsck on both / and /home file systems. / was OK. Then I had problem in getting fsck cleared for /home. Then I was forced to use “fsck -p /home” (automatic fixing) and “fsck -y /home” (select yes for all prompts automatically). After these run, /home passed fsck successfully. But the real stuff showed its face when I mount /home. None of my user files were there /home excpet lost+found directory. I had 5 user home directory for myself and my family members. None of them found. Here is how I recovered them. Yesterday only I thought of writing a post on fsck commands and data recovery in linux, Oh, God! You have made me to experience immediately with my live data :-) Enough, let us go to steps which I followed.

1. At this step, /home file system passed fsck in Ubuntu recovery shell. I have mounted it on /home. I found that my file system used space remains same as that of before crash. It gives some hope of recovering. I run “df -h” command to know this.

2. In lost+found folder I find more than 10000 folders with its name as some random number prefixed with # symbol. fsck has moved my files here in this structure while running. Now my job is to identify the right directory and files and move them out of lost+found. So I run “file *” in lost+found to know the type of files. It lists some thing like,

#7479417:  directory
#7479418:  directory
#7479419:  directory
#7602560:  directory
#7603310:  MPEG sequence, v2, program multiplex
#7603464:  JPEG image data, JFIF standard 1.02
#7603542:  Audio file with ID3 version 2.3.0, contains: Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 320 kbps, 44.1 kHz, JntStereo
#7604043:  ISO 9660 CD-ROM filesystem data 'Linux Mint 9 Isadora           ' (bootable)
#7604089:  ISO 9660 CD-ROM filesystem data 'netbook-x86_64-201005242312    ' (bootable)
#7605425:  MPEG sequence, v2, program multiplex
#7605470:  MPEG sequence, v2, program multiplex
#7605484:  MPEG sequence, v2, program multiplex
#7607478:  gzip compressed data, from Unix, last modified: Fri May 14 07:55:35 2010
#7607788:  gzip compressed data, from Unix, last modified: Tue May  4 14:16:31 2010
#7610801:  PDF document, version 1.4
#7612061:  ISO 9660 CD-ROM filesystem data 'Ubuntu 10.04 LTS amd64         ' (bootable)
#7613228:  directory
#7613583:  directory
#7613588:  directory

3. Then I filtered out all files except “directory” using “file * | grep directory > /root/list.dir” command.

4. Edited /root/list.dir to make it as script to show the list of files in each directory with directory name. Here is a snippet of my script.

set -v
ls -l \#10104455
ls -l \#10104531
ls -l \#10104536
………

The “set -v” will help you to echo the command the shell execute. “chmod +x list.dir” to make it executable.

5. Now run the script in /home/lost+found folder, redirecting the output to /tmp/ (“./list.dir 1> /tmp/dir.out 2>&1“). Now search for your known file in dir.out output file. I searched for “Desktop” and found some thing like this..

ls -l \#7733249
total 5704
drwxr-xr-x 2 1002 1002    4096 2010-06-05 13:24 Desktop
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Documents
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Downloads
-rw-r--r-- 1 1002 1002     179 2010-04-30 09:14 examples.desktop
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Music
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Pictures
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Public
-rw-r--r-- 1 1002 1002 5794003 2010-05-15 11:00 scrap001_a.ora
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Templates
-rw-r--r-- 1 1002 1002    1265 2010-05-20 14:35 tinda chuteny
drwxrwxr-x 2 1002 1002    4096 2010-05-23 14:57 Ubuntu One
drwxr-xr-x 2 1002 1002    4096 2010-04-30 09:15 Videos

6. So, my home directory is #7733249. I moved this folder out of lost+found and rename it as it was.

7. I checked the size of my home directory, it was same as pre-crash period approx. I did some manual verification of files and managed to find a few missing. I can do the above exercise further in lost+found and identify any missing files :-)

Update: I have found the missing files easily using the above method. Now I have got complete data back :-)

Depending on the type of error fsck fixed, there are chances of getting the data back, you may also have good chances of getting it. Please share your comments and experience on this.

30 comments for “How to recover files from lost+found after fsck in linux (How I did it in Ubuntu)

  1. Josh
    June 27, 2014 at 9:06 pm

    Very good! I was able to recover my /home. Now to determine what I did to destroy my file system. Thanks for the tip!

  2. May 27, 2014 at 9:57 pm

    Hi,
    Black dog’ hack looks handy.
    I have an ext2 partition full of data used on my android, with all its content into Lost+Found. nothing’s lost if believe df -m.
    Now, using ‘file …*’ showed 3 directories, android app only not the data one.
    Therefore I coudn’t go further. Dunno what “intelligent” (cough cough) step I may have done, argh :/

    @Sisayie and @Ptg Thanks you for the sed simplifying commands.
    Well actually both ended quickly in this location :

    sed: -e expression n°1, caractère 1: commande inconnue: `â’

    Maybe someone knows how to make these two commands work with non ASCII file names.

  3. December 11, 2013 at 11:03 pm

    Here’s the whole process as a short script, which runs on filesystem /dev/sd?? and outputs to /tmp/listing:

    fsck -y /dev/sd??
    mkdir /tmp/recover
    mount /dev/sd?? /tmp/recover -o rw
    cd /tmp/recover-lost+found
    (
    echo ‘set -v’
    file * | grep directory 2>/dev/null | perl -pe ‘s/^(\#[0-9]+)\:.*$/ls -l ‘”‘”‘$1′”‘”‘/’
    ) | sh > /tmp/listing

    Enjoy!

    • December 11, 2013 at 11:04 pm

      Note: requires root access, do a “sudo -i” or a “sudo su -” before running those commands!

  4. ravinder singh
    November 22, 2013 at 1:11 pm

    I am getiing “202 vmware-9.log entry no 22 doesn’t exist” errors in fsck logs. those files have been moved to lost and found and got renamed. is there a way I can link them using those numbers in fsck logs?

  5. June 25, 2013 at 7:36 pm

    Do you know of a good way to batch “file *”? I have thousands of inode pointers. Right now I’m running “file \#1*” and incrementing the number so I don’t run out of file buffers.

  6. April 1, 2013 at 6:46 am

    Hi

    I am stuck from Step 4 onwards. Can you please elaborate? I’d really appreciate it.

  7. March 4, 2013 at 2:02 pm

    Your problem was in that that you have run wrong fsck :)

    When you run fsck only it usually run as fsck.ext2 and that is why it have marked all your files as invalid and moved them to the lost+found.
    Next time when you run fsck command remember to do it as fsck.ext3 for ext3 and fsck.ext4 for ext4. I assume you have ext4 filesystem on ubuntu so you should have used fsck.ext4 :)

    Also if you would have a bad disk that has made corruption of your data you could not then succeed in restoring data on same partition, you would get errors and you couldn’t restore.

  8. upe
    February 20, 2013 at 2:29 am

    Thanks for this blog. This itself has helped me to identify my data in lost+found. Very good information.
    God bless

  9. Enkouyami
    July 17, 2012 at 7:08 pm

    What kind of script is this and how do I make it work? I’m only familiar with bash.

  10. Niyati277
    June 15, 2012 at 5:01 pm

    I came across this, while searching for recovering files from lost+found
    It is in rescue mode.. i did fsck on / partition and all is gone… to lost+found

    file *
    there is no such command
    any idea for recovering

    • Jt
      June 22, 2012 at 5:58 am

      Use some form of live bootable image, or in rescue mode (I don’t see how you’re in rescue if / is gone, but continuing…) you can go to lost+found and “ls -a /* 2>/dev/null | grep bin | grep -w file”, this will hopefully allow you to find and run file by typing in the absolute file path.
      Best of luck,
      Jack

    • Blah
      August 7, 2012 at 9:50 pm

      Use a live CD.

  11. G Dushime
    June 7, 2012 at 1:00 pm

    For me it’s special now! i have red hat 4 on my machine ; on the beginnig i had du and df which showing different result by handling that issue i typed fsck command / then root directory become apparently free of use and all files from different directories became apperently empty after that i tried to restart the machine by thinking that it will be fixed after reboot it and hang at this stage:

    Minimal BASH-like line editing is supported. For the first word, TAB lists possible command completions. Anywhere else TAB lists the possible completions of a device/file name.

    grub> root (hd0,1)
    Filesystem type is ext2fs, partition type 0×83
    grub> setup (hd0)
    Checking if “/boot/grub/stage1? exists… no

  12. Taltos
    June 6, 2012 at 8:38 am

    Huge thanks for this!

  13. Oberon
    May 18, 2012 at 9:31 pm

    Life saver! Thanks for posting this. I did the typical “take care of everyone else’s stuff, forget about your own” and I didn’t have a backup in place. Thought I was HOOPED. This little tut seriously saved my hide.

  14. fivestar
    May 12, 2012 at 3:46 pm

    Thanks a lot for this article.
    Saved my day!

  15. K Vasanthkumar
    August 24, 2011 at 5:27 pm

    hi iam useing rhel 4 when i editing some santhosh file not saved the system is automatic rebooted hoe to recover santhosh file

  16. Sisayie
    August 1, 2011 at 12:49 pm

    You can automate appending “ls -l ” in each line as follows

    sed -e ‘s/^/ls -l \/’ file >file.new

    It saves your time significantly.

    • Ptg
      May 17, 2012 at 3:22 am

      and sed -e ‘s/:.*//’ file.new > file2.new to remove the ‘: directory:’

  17. Sisayie
    August 1, 2011 at 12:13 pm

    Thanks. It saved my life.

  18. February 8, 2011 at 1:56 pm

    Thanks for this article mate, saved a lot of my data using ideas from here! My scripts and tinkering was a bit different but this article helped a lot!

    One suggestion, i used “ls -al” instead to get the hidden files showing too.

    Thank you!

  19. Chris
    December 27, 2010 at 4:55 pm

    I ran across this blog after hours on the net and am thankfully getting back on track. One thing I found useful was to “find >/tmp/find_dump.dir” this shows you a bit more of the structure on the lost+found. I am still working on restoring data, but I figured this may come in handy.

  20. SLN Rao
    December 16, 2010 at 2:57 pm

    does it work for solaris also.

    • December 16, 2010 at 4:39 pm

      I haven’t tried it in Solaris. But the same concept you can apply there. There may be some specific format of files dumped in lost+found incase of other file systems in Solaris.

  21. max
    December 13, 2010 at 1:41 am

    I’ve used your input after a ddrescue session (failing hard drive). Unfortunately it was a data drive with a lot of pictures and I didn’t have it that easy. Still, better than a significant part of my digital life vanishing in oblivion…

  22. December 8, 2010 at 12:44 pm

    mmkay so I spent the last 10 mins looking for the same theme you’re using and cannot find it. Didn’t want to have to ask but really would like to use it for my blog, could you let me know? I’ll look back here soon for any replies. Thanks

  23. October 21, 2010 at 1:29 pm

    Very Good response & technical input to restore teh data from Lost+found to Normal mode…

    Thank you…

    Regards,
    Navaneethan

Leave a Reply

Your email address will not be published. Required fields are marked *