How to Recover Files from the Linux `lost+found` Directory? A Complete Guide

🚀

If your Linux system encounters a file system error and you run fsck to repair it, you may notice that some unknown files appear in the /lost+found directory. These files are orphaned inodes that have lost their directory index due to file system inconsistencies.

So, how can you recover these files? This guide will explain how lost+found works and provide step-by-step methods to recover lost files efficiently.

📌 1. What is the lost+found Directory?

The /lost+found directory is a built-in feature of the ext2/ext3/ext4 file systems. It is used by fsck to store recovered files when a file still exists on disk but its directory entry is missing.

🔹 How Does fsck Handle Lost Files?

When fsck detects orphaned inodes, it moves them to /lost+found and renames them using inode numbers, such as:

/lost+found/#12345
/lost+found/#67890

⚠️ Important: These numbers are inode identifiers, not original filenames. To recover them, we need to determine their type and content.

🔍 2. How to Check the lost+found Directory?

To see which files exist in /lost+found, run:

ls -lh /lost+found

📌 Example Output

-rw-r--r--  1 root root 10M Feb 11 10:30 #12345
-rw-r--r--  1 root root 20K Feb 11 10:32 #67890

These files could be:

• Configuration files
• Text files
• Database files
• Logs
• Images

Now, let’s determine what these files actually are. 👇

🛠️ 3. How to Identify Files in lost+found?

Once files are moved to /lost+found, their original names are lost, but their content remains intact. We need to analyze them before recovery.

🔹 3.1 Use the file Command to Identify File Types

Run the following command:

file /lost+found/*

📌 Example Output

/lost+found/#12345: ASCII text
/lost+found/#67890: JPEG image data
/lost+found/#54321: gzip compressed data

🔹 3.2 Manually Inspect Text Files

If the file command indicates a text file, check its content:

cat /lost+found/#12345
less /lost+found/#12345

If it contains readable content, it may be a log, configuration file, or script.

🔹 3.3 Search for Keywords Using grep

If you remember specific words from the lost file, search using:

grep -r "database" /lost+found/

For example, if looking for MySQL or PostgreSQL database files:

grep -r "mysql" /lost+found/

For binary files, extract readable content using:

strings /lost+found/#12345 | less

🔹 3.4 Check Inode Information

You can check inode details using debugfs:

debugfs /dev/sdb5

Once inside debugfs, enter:

stat 12345

This displays:

• File size
• Creation date
• Last modification time

This information helps determine whether a file is recently modified or an older backup.

🔄 4. How to Recover Files from lost+found?

Once a file is identified, restore it to the correct location.

🔹 4.1 Recover to a Specific Directory

If you’ve confirmed a file is important, move it:

mv /lost+found/#12345 /home/user/important_file.txt
mv /lost+found/#67890 /var/www/html/image.jpg

For bulk recovery, move all files:

mv /lost+found/* /home/user/recovered_files/

🔹 4.2 Recover Database Files

If the recovered files belong to MySQL/PostgreSQL databases, follow these steps:

1️⃣ Move the database file back to the appropriate directory

mv /lost+found/#54321 /var/lib/mysql/recovered_db.ibd

2️⃣ Ensure Correct File Permissions

chown mysql:mysql /var/lib/mysql/recovered_db.ibd
chmod 660 /var/lib/mysql/recovered_db.ibd

3️⃣ Reimport the Database Table

mysql -u root -p -e "ALTER TABLE my_table IMPORT TABLESPACE;"

🛡️ 5. How to Prevent Files from Ending Up in lost+found?

Prevent data loss and avoid fsck from moving files to /lost+found with these best practices:

🔹 5.1 Regular Backups

Always keep up-to-date backups of important data:

tar -czf /backup/system_backup.tar.gz /

🔹 5.2 Proper Shutdown Procedures

Avoid forced shutdowns or power failures:

shutdown -h now

🔹 5.3 Monitor Disk Health

Use smartctl to check for disk failures:

smartctl -a /dev/sdb

🔹 5.4 Run fsck Regularly

Check for file system errors before they cause problems:

fsck -n /dev/sdb5

📌 The -n option checks for errors without making any repairs.

📊 6. Summary

💬 Join the Discussion!

Have you ever lost files in Linux due to file system errors?
What methods did you use to recover them?

💬 Share your recovery tips in the comments below! 🚀

👉 If you're troubleshooting Linux boot issues, check out: How to Fix Linux Boot Failure Due to File System Errors