Let's say I have the following directory structure, in an ext4 filesystem:


(in other words, a/b/1, a/b/2, ... a/b/9)

Suppose I am writing to a/b, and then I lose power. fsck runs and finds some files (a/b/1, a/b/2, etc.) and puts them in lost+found.

Now, the question is, would all of the missing files that were placed in lost+found be under the same directory? So for example if every file 1-9 was lost, is it guaranteed that lost+found would contain something like: lost+found/#1234567/*, where the folder #1234567 contains all the files 1-9? Or is it possible for them to be spread out into separate directories like: lost+found/#1234567/1, lost+found/#7654321/2, etc.?

I'm asking because I am trying to understand how I might go about systematically recovering a specific folder that was lost, and whether they would already be grouped together in lost+found, or whether I would have to check every existing file in lost+found to find the missing pieces.

  • Can you clarify your question by giving a specific filesystem type or, if this is an assignment, adding the complete text to the question? The answer also depends on whether only a or only b or both have been corrupted. – Mark Plotnick Apr 25 at 6:29
  • @MarkPlotnick this isn't an assignment, this is just a general question about filesystem behavior. I'll edit the question, thanks! – jj172 Apr 25 at 6:44
  • @MarkPlotnick also I'm really not sure which of the directories got corrupted - could you explain the various scenarios? Is there any situation in which they would not be located together? – jj172 Apr 25 at 6:46

Inodes are put into lost+found/ when there is no directory entry referencing them, so there is no "name" for the inode. If the parent directory (a/ in this case) was lost/corrupted (either the inode itself, or the directory block(s) that hold the name-to-inode mapping for each file/directory therein), then it is likely inode b/ would be put into lost+found/ with the name #inode_number. If b/ itself is not corrupted then all of the entries (1..9) would still be inside, and you could rename #inode_number out of lost+found/ back to where it came from.

That said, if a/ and b/ were created at nearly the same time, they will likely be physically close together on disk, so it is possible they might both be corrupted at the same time.

If b/ is corrupted, then the files therein will be individually put into lost+found/ and they will need to be identified by UID/GID and/or content.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.