-1

Let's say I have the following directory structure, in an ext4 filesystem:

a/b/{1..9}

(in other words, a/b/1, a/b/2, ... a/b/9)

Suppose I am writing to a/b, and then I lose power. fsck runs and finds some files (a/b/1, a/b/2, etc.) and puts them in lost+found.

Now, the question is, would all of the missing files that were placed in lost+found be under the same directory? So for example if every file 1-9 was lost, is it guaranteed that lost+found would contain something like: lost+found/#1234567/*, where the folder #1234567 contains all the files 1-9? Or is it possible for them to be spread out into separate directories like: lost+found/#1234567/1, lost+found/#7654321/2, etc.?

I'm asking because I am trying to understand how I might go about systematically recovering a specific folder that was lost, and whether they would already be grouped together in lost+found, or whether I would have to check every existing file in lost+found to find the missing pieces.

Jeff Schaller
  • 66,199
  • 35
  • 114
  • 250
jj172
  • 313
  • 1
  • 4
  • 11
  • Can you clarify your question by giving a specific filesystem type or, if this is an assignment, adding the complete text to the question? The answer also depends on whether only a or only b or both have been corrupted. – Mark Plotnick Apr 25 '19 at 06:29
  • @MarkPlotnick this isn't an assignment, this is just a general question about filesystem behavior. I'll edit the question, thanks! – jj172 Apr 25 '19 at 06:44
  • @MarkPlotnick also I'm really not sure which of the directories got corrupted - could you explain the various scenarios? Is there any situation in which they would not be located together? – jj172 Apr 25 '19 at 06:46

1 Answers1

2

Inodes are put into lost+found/ when there is no directory entry referencing them, so there is no "name" for the inode. If the parent directory (a/ in this case) was lost/corrupted (either the inode itself, or the directory block(s) that hold the name-to-inode mapping for each file/directory therein), then it is likely inode b/ would be put into lost+found/ with the name #inode_number. If b/ itself is not corrupted then all of the entries (1..9) would still be inside, and you could rename #inode_number out of lost+found/ back to where it came from.

That said, if a/ and b/ were created at nearly the same time, they will likely be physically close together on disk, so it is possible they might both be corrupted at the same time.

If b/ is corrupted, then the files therein will be individually put into lost+found/ and they will need to be identified by UID/GID and/or content.

LustreOne
  • 1,555
  • 5
  • 19