Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Recently, my HDD crashed and I had to run a fsck command. Many files were moved to the lost+found folder and I've retrieved the important ones using find and grep, but I can't find my SQL databases.
Try #1:
Maybe it is there yet, only its name changed to f.e. /lost+found/#3456254 and like. In your place I did a recursive file -szL for everything in /lost+found, and grepped for innodb:
find /lost+found -type f|xargs -P 1 -n 500 file -szL|grep -i innodb
If there is an innodb database yet therein, you have your data to save. Good luck!
Try #2:
If your database had a lot of textual data, a sector-based hexa search could also help you.
It IS possible that the file(s) in question were unable to be reconstructed by fsck that they were deleted. The fsck program only attempts to repair and tries very hard to reconstruct files as well as it can. However, it is by no means any type of backup. Any action that is performed by fsck is basically not reversible.
I'd be really careful about attempting to use portions of a MySQL database contained in a lost+found directory as a database is not contained in one file but many files which must be in "sync" to have any hope of database recovery in a mode where there is any type of reliability or data integrity.
As for file recovery, sorry, you'll have to go back to the backups that you have presumably been making since the data was important. Otherwise, you are really out of luck.
If the data is so important, then you MIGHT be able to try to enlist the help of one of the many data recovery services. It is pricey and the results are less than perfect.
I believe you're out of luck. The only option you have is to go through the lost+found directory and visually inspect each file looking for clues as to its original identify.
There is this blog post titled: Updated: Automatically restore files from lost+found, which discusses 2 tools which would've helped in this scenario.
make-lsLR.sh- call this regularly (cron) to create the needed files that are stored in /root/. Of course you can alter the location easily and exclude other directories from being scanned.
check_lost+found.py- The second script is to be run when your fsck managed to mess up with your files and stored them into lost+found directory. It takes 3 arguments: 1) the source directory where your messed up lost+found directory is, 2) the target directory to which the data will be saved and 3) a switch to actually make it happen instead of a dry-run.
The 2 scripts work together, the 1st would need to be run periodically, to build an inventory of the files that are present on your system. The 2nd script can then make use of this inventory in the event you need to restore files from a lost+found directory.
