Yesterday, My Ubuntu 10.04 was not able to boot, displaying “Continue to wait; Press S to skip mounting or M for manual recovery” due to file system error in / and /home partitions. I went ahead with Recovery boot option and run fsck on both / and /home file systems. / was OK. Then I had problem in getting fsck cleared for /home. Then I was forced to use “fsck -p /home” (automatic fixing) and “fsck -y /home” (select yes for all prompts automatically). After these run, /home passed fsck successfully. But the real stuff showed its face when I mount /home. None of my user files were there /home excpet lost+found directory. I had 5 user home directory for myself and my family members. None of them found. Here is how I recovered them. Yesterday only I thought of writing a post on fsck commands and data recovery in linux, Oh, God! You have made me to experience immediately with my live data 
Enough, let us go to steps which I followed.
1. At this step, /home file system passed fsck in Ubuntu recovery shell. I have mounted it on /home. I found that my file system used space remains same as that of before crash. It gives some hope of recovering. I run “df -h” command to know this.
2. In lost+found folder I find more than 10000 folders with its name as some random number prefixed with # symbol. fsck has moved my files here in this structure while running. Now my job is to identify the right directory and files and move them out of lost+found. So I run “file *” in lost+found to know the type of files. It lists some thing like,
#7479417: directory #7479418: directory #7479419: directory #7602560: directory #7603310: MPEG sequence, v2, program multiplex #7603464: JPEG image data, JFIF standard 1.02 #7603542: Audio file with ID3 version 2.3.0, contains: Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 320 kbps, 44.1 kHz, JntStereo #7604043: ISO 9660 CD-ROM filesystem data 'Linux Mint 9 Isadora ' (bootable) #7604089: ISO 9660 CD-ROM filesystem data 'netbook-x86_64-201005242312 ' (bootable) #7605425: MPEG sequence, v2, program multiplex #7605470: MPEG sequence, v2, program multiplex #7605484: MPEG sequence, v2, program multiplex #7607478: gzip compressed data, from Unix, last modified: Fri May 14 07:55:35 2010 #7607788: gzip compressed data, from Unix, last modified: Tue May 4 14:16:31 2010 #7610801: PDF document, version 1.4 #7612061: ISO 9660 CD-ROM filesystem data 'Ubuntu 10.04 LTS amd64 ' (bootable) #7613228: directory #7613583: directory #7613588: directory
3. Then I filtered out all files except “directory” using “file * | grep directory > /root/list.dir” command.
4. Edited /root/list.dir to make it as script to show the list of files in each directory with directory name. Here is a snippet of my script.
The “set -v” will help you to echo the command the shell execute. “chmod +x list.dir” to make it executable.
5. Now run the script in /home/lost+found folder, redirecting the output to /tmp/ (“./list.dir 1> /tmp/dir.out 2>&1“). Now search for your known file in dir.out output file. I searched for “Desktop” and found some thing like this..
ls -l \#7733249 total 5704 drwxr-xr-x 2 1002 1002 4096 2010-06-05 13:24 Desktop drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Documents drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Downloads -rw-r--r-- 1 1002 1002 179 2010-04-30 09:14 examples.desktop drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Music drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Pictures drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Public -rw-r--r-- 1 1002 1002 5794003 2010-05-15 11:00 scrap001_a.ora drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Templates -rw-r--r-- 1 1002 1002 1265 2010-05-20 14:35 tinda chuteny drwxrwxr-x 2 1002 1002 4096 2010-05-23 14:57 Ubuntu One drwxr-xr-x 2 1002 1002 4096 2010-04-30 09:15 Videos
6. So, my home directory is #7733249. I moved this folder out of lost+found and rename it as it was.
7. I checked the size of my home directory, it was same as pre-crash period approx. I did some manual verification of files and managed to find a few missing. I can do the above exercise further in lost+found and identify any missing files
Update: I have found the missing files easily using the above method. Now I have got complete data back
Depending on the type of error fsck fixed, there are chances of getting the data back, you may also have good chances of getting it. Please share your comments and experience on this.
Hi
I am stuck from Step 4 onwards. Can you please elaborate? I’d really appreciate it.
Your problem was in that that you have run wrong fsck
When you run fsck only it usually run as fsck.ext2 and that is why it have marked all your files as invalid and moved them to the lost+found.
Next time when you run fsck command remember to do it as fsck.ext3 for ext3 and fsck.ext4 for ext4. I assume you have ext4 filesystem on ubuntu so you should have used fsck.ext4
Also if you would have a bad disk that has made corruption of your data you could not then succeed in restoring data on same partition, you would get errors and you couldn’t restore.
Thanks for this blog. This itself has helped me to identify my data in lost+found. Very good information.
God bless
What kind of script is this and how do I make it work? I’m only familiar with bash.
I came across this, while searching for recovering files from lost+found
It is in rescue mode.. i did fsck on / partition and all is gone… to lost+found
file *
there is no such command
any idea for recovering
Use some form of live bootable image, or in rescue mode (I don’t see how you’re in rescue if / is gone, but continuing…) you can go to lost+found and “ls -a /* 2>/dev/null | grep bin | grep -w file”, this will hopefully allow you to find and run file by typing in the absolute file path.
Best of luck,
Jack
Use a live CD.
For me it’s special now! i have red hat 4 on my machine ; on the beginnig i had du and df which showing different result by handling that issue i typed fsck command / then root directory become apparently free of use and all files from different directories became apperently empty after that i tried to restart the machine by thinking that it will be fixed after reboot it and hang at this stage:
Minimal BASH-like line editing is supported. For the first word, TAB lists possible command completions. Anywhere else TAB lists the possible completions of a device/file name.
grub> root (hd0,1)
Filesystem type is ext2fs, partition type 0×83
grub> setup (hd0)
Checking if “/boot/grub/stage1? exists… no
Huge thanks for this!
Life saver! Thanks for posting this. I did the typical “take care of everyone else’s stuff, forget about your own” and I didn’t have a backup in place. Thought I was HOOPED. This little tut seriously saved my hide.
Pingback: fix disk errors ubuntu « onthou
Thanks a lot for this article.
Saved my day!
hi iam useing rhel 4 when i editing some santhosh file not saved the system is automatic rebooted hoe to recover santhosh file
You can automate appending “ls -l ” in each line as follows
sed -e ‘s/^/ls -l \/’ file >file.new
It saves your time significantly.
and sed -e ‘s/:.*//’ file.new > file2.new to remove the ‘: directory:’
Thanks. It saved my life.
Thanks for this article mate, saved a lot of my data using ideas from here! My scripts and tinkering was a bit different but this article helped a lot!
One suggestion, i used “ls -al” instead to get the hidden files showing too.
Thank you!
I ran across this blog after hours on the net and am thankfully getting back on track. One thing I found useful was to “find >/tmp/find_dump.dir” this shows you a bit more of the structure on the lost+found. I am still working on restoring data, but I figured this may come in handy.
does it work for solaris also.
I haven’t tried it in Solaris. But the same concept you can apply there. There may be some specific format of files dumped in lost+found incase of other file systems in Solaris.
I’ve used your input after a ddrescue session (failing hard drive). Unfortunately it was a data drive with a lot of pictures and I didn’t have it that easy. Still, better than a significant part of my digital life vanishing in oblivion…
mmkay so I spent the last 10 mins looking for the same theme you’re using and cannot find it. Didn’t want to have to ask but really would like to use it for my blog, could you let me know? I’ll look back here soon for any replies. Thanks
This theme is heavily customized (by me) version of “Dojo” http://spaceninja.com/dojo/ theme.
Very Good response & technical input to restore teh data from Lost+found to Normal mode…
Thank you…
Regards,
Navaneethan