Lost+found Directory

[sdjf]

My 2.38 sl5500 has a directory called

/home/lost+found/ .   I am wondering if the files might have some use after any kinds of crashes.  Does anyone know what they are and whether they can be used in recoveries?

On my Z they are:

-rw-rw-rw-    1 root     root          4656 Dec 16 00:55 #3912

-rw-rw-rw-    1 root     root          5201 Dec 19 16:45 #3983

Thanks,
sdjf

[dtruchan]

Read this.

[sdjf]

I did.  But it doesn't say how to tell what kind of files they are (socket vs. real files) or how to know where they came from.   Seems to be just a synopsis when I need a more detailed, focussed explanation.

It's a start, but...need more help.

Thanks,

sdjf

[polito]

The way to tell what a directory entry actually is would be to examine the long listing from the 'ls' command:

From my ubuntu system, I did an 'ls' of a few files just to give you a bit of an explanation.

Code: [Select]

$ ls -ld /dev/{xconsole,hda,null,cdrom} /dev /etc/passwd /var/run/mysqld/mysqld.sock
drwxr-xr-x  12 root root  14480 2005-12-31 07:35 /dev
brw-rw----   1 root cdrom  3, 0 2005-10-30 21:09 /dev/hda
crw-rw-rw-   1 root root   1, 3 2005-10-30 21:09 /dev/null
lrwxrwxrwx  1 root root 3 2005-10-30 21:09 /dev/cdrom -> hda
prw-r-----   1 root adm       0 2005-12-31 14:30 /dev/xconsole
-rw-r--r--   1 root root   1438 2005-09-18 17:39 /etc/passwd
srwxrwxrwx  1 mysql mysql 0 2005-10-30 21:09 /var/run/mysqld/mysqld.sock
When you do an 'ls' with the '-l' command you get the permissions and other attributes of the files listed. With regular files like /etc/passwd you only see file permissions,

-rw-r--r--  which translates to User has read/write permissions, Group has read permission, and Others have read permission. But if you look closely and if you remember from seeing other listings of files, there is one extra space beyond the 9 required to show Read, Write, eXecute permissions for User, Group, and Others. That first space is an indicator of what kind of file it is.

Regular files won't have anything but a dash usually.
Directories will start with a leading 'd' as /dev has above.
Block device files start with a leading 'b' as /dev/hda has above.
Character device files start with a leading 'c' as /dev/null has above.
Symbolic Links start with a leading 'l' (that's ELL) as /dev/cdrom has above.
Pipes (FIFO's) start with a leading 'p' as /dev/xconsole has above.
Sockets start with a leading 's' as /var/run/mysqld/mysqld.sock has above.

Generally I've not had much sucess with finding usable data in the lost+found directory. Sometimes you might get a snippet of something though and when you do, you're really glad that it was there. If anything it can help you decide what needs to be updated on your system (if you're using rpm and such) because you can sometimes determine if certain packages were corrupted and then have rpm re-install them.

Hope that helps.