Restore from lost+found

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
5
down vote

favorite
2












There was a problem on an EXT4 FS/memorycard and after and fsck all the files were put in the lost+found.



Question: how can I restore the old filename/hierarchy from the lost+found? Or it is impossible? Not counting a restore from backup.










share|improve this question























  • It won't restore the old hierarchy but if they are pictures, some photo organizer programs will read the EXIF data from the pictures and can import the files into a year/month/day hierarchy for you.
    – drewbenn
    Jan 6 '15 at 22:01














up vote
5
down vote

favorite
2












There was a problem on an EXT4 FS/memorycard and after and fsck all the files were put in the lost+found.



Question: how can I restore the old filename/hierarchy from the lost+found? Or it is impossible? Not counting a restore from backup.










share|improve this question























  • It won't restore the old hierarchy but if they are pictures, some photo organizer programs will read the EXIF data from the pictures and can import the files into a year/month/day hierarchy for you.
    – drewbenn
    Jan 6 '15 at 22:01












up vote
5
down vote

favorite
2









up vote
5
down vote

favorite
2






2





There was a problem on an EXT4 FS/memorycard and after and fsck all the files were put in the lost+found.



Question: how can I restore the old filename/hierarchy from the lost+found? Or it is impossible? Not counting a restore from backup.










share|improve this question















There was a problem on an EXT4 FS/memorycard and after and fsck all the files were put in the lost+found.



Question: how can I restore the old filename/hierarchy from the lost+found? Or it is impossible? Not counting a restore from backup.







data-recovery fsck lost-found






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Jan 6 '15 at 22:47









Gilles

524k12610481578




524k12610481578










asked Jan 6 '15 at 8:09







user90825


















  • It won't restore the old hierarchy but if they are pictures, some photo organizer programs will read the EXIF data from the pictures and can import the files into a year/month/day hierarchy for you.
    – drewbenn
    Jan 6 '15 at 22:01
















  • It won't restore the old hierarchy but if they are pictures, some photo organizer programs will read the EXIF data from the pictures and can import the files into a year/month/day hierarchy for you.
    – drewbenn
    Jan 6 '15 at 22:01















It won't restore the old hierarchy but if they are pictures, some photo organizer programs will read the EXIF data from the pictures and can import the files into a year/month/day hierarchy for you.
– drewbenn
Jan 6 '15 at 22:01




It won't restore the old hierarchy but if they are pictures, some photo organizer programs will read the EXIF data from the pictures and can import the files into a year/month/day hierarchy for you.
– drewbenn
Jan 6 '15 at 22:01










5 Answers
5






active

oldest

votes

















up vote
2
down vote



accepted










Last time I had to do that - many years ago - you had to guess based on file content. I doubt there is a better way today.



The 'file' program can help here since it will give you an idea of the type of data, so you can use this to view the files appropriately for a start.






share|improve this answer



























    up vote
    4
    down vote













    You can't find the original name and location of a file in /lost+found because that's what lost+found is about: it's where fsck puts fragments of files that it hasn't been able to attach anywhere in the directory tree. If the location was known, fsck would have left the file where it was meant to be.



    It's theoretically possible that fsck could have only partial information, such as the file name but not the directory location, but that doesn't happen with typical filesystem.



    You may be able to find clues in the file itself. The file command will at least tell you what kind of file it is (if it recognizes it). Some files carry additional information inside; for example JPEG and TIFF images may contain EXIF data, MP3 files may contain ID3 tags, etc.






    share|improve this answer





























      up vote
      0
      down vote













      The real answer is that you shouldn't try. You have no idea if the contents are complete. You should restore from a known good copy.






      share|improve this answer



























        up vote
        0
        down vote













        File names and hierarchy no, but using file can help you recover some stuff. I use the Joe editor which has rectangular selections if you enable them. So I could do "ls > ques" then search-replace to turn it into a list of statements like 'file "#133024" > 133024.txt'. I ran that as an sh script, then I could do 'grep PDF *.txt > pdflist'. With that open in an mc viewer and another mc in another terminal I looked through pdflist.txt and moved all the PDFs into their own directory. You can do the same with ASCII text files and whatever else it identifies.



        There are also the odd surprises like '#410423: gzip compressed data, was "x264_git.tar"'. You can also 'cat *.txt > filelist' to get the descriptions all in one file.






        share|improve this answer



























          up vote
          0
          down vote













          In my case there was I/O error during reading. And after run of e2fsck I've found most of my files in lost+found in subfolders, and most files (and filenames) was ok.



          So go to lost+found, run



          find | less


          and see if you will find your files. Good luck!






          share|improve this answer




















            Your Answer








            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "106"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader:
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            ,
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );













            draft saved

            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f177691%2frestore-from-lostfound%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown
























            5 Answers
            5






            active

            oldest

            votes








            5 Answers
            5






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes








            up vote
            2
            down vote



            accepted










            Last time I had to do that - many years ago - you had to guess based on file content. I doubt there is a better way today.



            The 'file' program can help here since it will give you an idea of the type of data, so you can use this to view the files appropriately for a start.






            share|improve this answer
























              up vote
              2
              down vote



              accepted










              Last time I had to do that - many years ago - you had to guess based on file content. I doubt there is a better way today.



              The 'file' program can help here since it will give you an idea of the type of data, so you can use this to view the files appropriately for a start.






              share|improve this answer






















                up vote
                2
                down vote



                accepted







                up vote
                2
                down vote



                accepted






                Last time I had to do that - many years ago - you had to guess based on file content. I doubt there is a better way today.



                The 'file' program can help here since it will give you an idea of the type of data, so you can use this to view the files appropriately for a start.






                share|improve this answer












                Last time I had to do that - many years ago - you had to guess based on file content. I doubt there is a better way today.



                The 'file' program can help here since it will give you an idea of the type of data, so you can use this to view the files appropriately for a start.







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered Jan 6 '15 at 21:23









                EricM

                32113




                32113






















                    up vote
                    4
                    down vote













                    You can't find the original name and location of a file in /lost+found because that's what lost+found is about: it's where fsck puts fragments of files that it hasn't been able to attach anywhere in the directory tree. If the location was known, fsck would have left the file where it was meant to be.



                    It's theoretically possible that fsck could have only partial information, such as the file name but not the directory location, but that doesn't happen with typical filesystem.



                    You may be able to find clues in the file itself. The file command will at least tell you what kind of file it is (if it recognizes it). Some files carry additional information inside; for example JPEG and TIFF images may contain EXIF data, MP3 files may contain ID3 tags, etc.






                    share|improve this answer


























                      up vote
                      4
                      down vote













                      You can't find the original name and location of a file in /lost+found because that's what lost+found is about: it's where fsck puts fragments of files that it hasn't been able to attach anywhere in the directory tree. If the location was known, fsck would have left the file where it was meant to be.



                      It's theoretically possible that fsck could have only partial information, such as the file name but not the directory location, but that doesn't happen with typical filesystem.



                      You may be able to find clues in the file itself. The file command will at least tell you what kind of file it is (if it recognizes it). Some files carry additional information inside; for example JPEG and TIFF images may contain EXIF data, MP3 files may contain ID3 tags, etc.






                      share|improve this answer
























                        up vote
                        4
                        down vote










                        up vote
                        4
                        down vote









                        You can't find the original name and location of a file in /lost+found because that's what lost+found is about: it's where fsck puts fragments of files that it hasn't been able to attach anywhere in the directory tree. If the location was known, fsck would have left the file where it was meant to be.



                        It's theoretically possible that fsck could have only partial information, such as the file name but not the directory location, but that doesn't happen with typical filesystem.



                        You may be able to find clues in the file itself. The file command will at least tell you what kind of file it is (if it recognizes it). Some files carry additional information inside; for example JPEG and TIFF images may contain EXIF data, MP3 files may contain ID3 tags, etc.






                        share|improve this answer














                        You can't find the original name and location of a file in /lost+found because that's what lost+found is about: it's where fsck puts fragments of files that it hasn't been able to attach anywhere in the directory tree. If the location was known, fsck would have left the file where it was meant to be.



                        It's theoretically possible that fsck could have only partial information, such as the file name but not the directory location, but that doesn't happen with typical filesystem.



                        You may be able to find clues in the file itself. The file command will at least tell you what kind of file it is (if it recognizes it). Some files carry additional information inside; for example JPEG and TIFF images may contain EXIF data, MP3 files may contain ID3 tags, etc.







                        share|improve this answer














                        share|improve this answer



                        share|improve this answer








                        edited Apr 13 '17 at 12:36









                        Community

                        1




                        1










                        answered Jan 6 '15 at 23:55









                        Gilles

                        524k12610481578




                        524k12610481578




















                            up vote
                            0
                            down vote













                            The real answer is that you shouldn't try. You have no idea if the contents are complete. You should restore from a known good copy.






                            share|improve this answer
























                              up vote
                              0
                              down vote













                              The real answer is that you shouldn't try. You have no idea if the contents are complete. You should restore from a known good copy.






                              share|improve this answer






















                                up vote
                                0
                                down vote










                                up vote
                                0
                                down vote









                                The real answer is that you shouldn't try. You have no idea if the contents are complete. You should restore from a known good copy.






                                share|improve this answer












                                The real answer is that you shouldn't try. You have no idea if the contents are complete. You should restore from a known good copy.







                                share|improve this answer












                                share|improve this answer



                                share|improve this answer










                                answered Jan 6 '15 at 21:57









                                bahamat

                                24k14690




                                24k14690




















                                    up vote
                                    0
                                    down vote













                                    File names and hierarchy no, but using file can help you recover some stuff. I use the Joe editor which has rectangular selections if you enable them. So I could do "ls > ques" then search-replace to turn it into a list of statements like 'file "#133024" > 133024.txt'. I ran that as an sh script, then I could do 'grep PDF *.txt > pdflist'. With that open in an mc viewer and another mc in another terminal I looked through pdflist.txt and moved all the PDFs into their own directory. You can do the same with ASCII text files and whatever else it identifies.



                                    There are also the odd surprises like '#410423: gzip compressed data, was "x264_git.tar"'. You can also 'cat *.txt > filelist' to get the descriptions all in one file.






                                    share|improve this answer
























                                      up vote
                                      0
                                      down vote













                                      File names and hierarchy no, but using file can help you recover some stuff. I use the Joe editor which has rectangular selections if you enable them. So I could do "ls > ques" then search-replace to turn it into a list of statements like 'file "#133024" > 133024.txt'. I ran that as an sh script, then I could do 'grep PDF *.txt > pdflist'. With that open in an mc viewer and another mc in another terminal I looked through pdflist.txt and moved all the PDFs into their own directory. You can do the same with ASCII text files and whatever else it identifies.



                                      There are also the odd surprises like '#410423: gzip compressed data, was "x264_git.tar"'. You can also 'cat *.txt > filelist' to get the descriptions all in one file.






                                      share|improve this answer






















                                        up vote
                                        0
                                        down vote










                                        up vote
                                        0
                                        down vote









                                        File names and hierarchy no, but using file can help you recover some stuff. I use the Joe editor which has rectangular selections if you enable them. So I could do "ls > ques" then search-replace to turn it into a list of statements like 'file "#133024" > 133024.txt'. I ran that as an sh script, then I could do 'grep PDF *.txt > pdflist'. With that open in an mc viewer and another mc in another terminal I looked through pdflist.txt and moved all the PDFs into their own directory. You can do the same with ASCII text files and whatever else it identifies.



                                        There are also the odd surprises like '#410423: gzip compressed data, was "x264_git.tar"'. You can also 'cat *.txt > filelist' to get the descriptions all in one file.






                                        share|improve this answer












                                        File names and hierarchy no, but using file can help you recover some stuff. I use the Joe editor which has rectangular selections if you enable them. So I could do "ls > ques" then search-replace to turn it into a list of statements like 'file "#133024" > 133024.txt'. I ran that as an sh script, then I could do 'grep PDF *.txt > pdflist'. With that open in an mc viewer and another mc in another terminal I looked through pdflist.txt and moved all the PDFs into their own directory. You can do the same with ASCII text files and whatever else it identifies.



                                        There are also the odd surprises like '#410423: gzip compressed data, was "x264_git.tar"'. You can also 'cat *.txt > filelist' to get the descriptions all in one file.







                                        share|improve this answer












                                        share|improve this answer



                                        share|improve this answer










                                        answered Jun 12 '17 at 3:20









                                        Alan Corey

                                        493




                                        493




















                                            up vote
                                            0
                                            down vote













                                            In my case there was I/O error during reading. And after run of e2fsck I've found most of my files in lost+found in subfolders, and most files (and filenames) was ok.



                                            So go to lost+found, run



                                            find | less


                                            and see if you will find your files. Good luck!






                                            share|improve this answer
























                                              up vote
                                              0
                                              down vote













                                              In my case there was I/O error during reading. And after run of e2fsck I've found most of my files in lost+found in subfolders, and most files (and filenames) was ok.



                                              So go to lost+found, run



                                              find | less


                                              and see if you will find your files. Good luck!






                                              share|improve this answer






















                                                up vote
                                                0
                                                down vote










                                                up vote
                                                0
                                                down vote









                                                In my case there was I/O error during reading. And after run of e2fsck I've found most of my files in lost+found in subfolders, and most files (and filenames) was ok.



                                                So go to lost+found, run



                                                find | less


                                                and see if you will find your files. Good luck!






                                                share|improve this answer












                                                In my case there was I/O error during reading. And after run of e2fsck I've found most of my files in lost+found in subfolders, and most files (and filenames) was ok.



                                                So go to lost+found, run



                                                find | less


                                                and see if you will find your files. Good luck!







                                                share|improve this answer












                                                share|improve this answer



                                                share|improve this answer










                                                answered Nov 30 at 8:56









                                                1844144

                                                1011




                                                1011



























                                                    draft saved

                                                    draft discarded
















































                                                    Thanks for contributing an answer to Unix & Linux Stack Exchange!


                                                    • Please be sure to answer the question. Provide details and share your research!

                                                    But avoid


                                                    • Asking for help, clarification, or responding to other answers.

                                                    • Making statements based on opinion; back them up with references or personal experience.

                                                    To learn more, see our tips on writing great answers.





                                                    Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


                                                    Please pay close attention to the following guidance:


                                                    • Please be sure to answer the question. Provide details and share your research!

                                                    But avoid


                                                    • Asking for help, clarification, or responding to other answers.

                                                    • Making statements based on opinion; back them up with references or personal experience.

                                                    To learn more, see our tips on writing great answers.




                                                    draft saved


                                                    draft discarded














                                                    StackExchange.ready(
                                                    function ()
                                                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f177691%2frestore-from-lostfound%23new-answer', 'question_page');

                                                    );

                                                    Post as a guest















                                                    Required, but never shown





















































                                                    Required, but never shown














                                                    Required, but never shown












                                                    Required, but never shown







                                                    Required, but never shown

































                                                    Required, but never shown














                                                    Required, but never shown












                                                    Required, but never shown







                                                    Required, but never shown






                                                    Popular posts from this blog

                                                    How to check contact read email or not when send email to Individual?

                                                    Bahrain

                                                    Postfix configuration issue with fips on centos 7; mailgun relay