There was a problem on an EXT4 FS/memorycard and after and fsck all the files were put in the lost+found.
Question: how can I restore the old filename/hierarchy from the lost+found? Or it is impossible? Not counting a restore from backup.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
You can't find the original name and location of a file in
/lost+found because that's what
lost+found is about: it's where
fsck puts fragments of files that it hasn't been able to attach anywhere in the directory tree. If the location was known,
fsck would have left the file where it was meant to be.
It's theoretically possible that
fsck could have only partial information, such as the file name but not the directory location, but that doesn't happen with typical filesystem.
You may be able to find clues in the file itself. The
file command will at least tell you what kind of file it is (if it recognizes it). Some files carry additional information inside; for example JPEG and TIFF images may contain EXIF data, MP3 files may contain ID3 tags, etc.
File names and hierarchy no, but using file can help you recover some stuff. I use the Joe editor which has rectangular selections if you enable them. So I could do "ls > ques" then search-replace to turn it into a list of statements like 'file "#133024" > 133024.txt'. I ran that as an sh script, then I could do 'grep PDF *.txt > pdflist'. With that open in an mc viewer and another mc in another terminal I looked through pdflist.txt and moved all the PDFs into their own directory. You can do the same with ASCII text files and whatever else it identifies.
There are also the odd surprises like '#410423: gzip compressed data, was "x264_git.tar"'. You can also 'cat *.txt > filelist' to get the descriptions all in one file.