User Tools

Site Tools


notes:recovery

Recover files from lost+found

You know the feeling: you are beavering away with whatever it is what you're doing and suddenly, you are confronted with a hard disk failure in your file server. In a brave attempt to get the failing partition at least mountable again, you unmount it and let e2fsck do its magic:

# e2fsck -p /dev/sde1

All well and done, the partition is mountable again. But everyhing is not back to normal, you discover only a single folder: “lost+found”. Looking into this folder, it seems that there are tons of files with a numeric filename, all in one single folder. GBs worth of finely assorted data turned into an undistinguishable mess. Great.

What next?

But it's not all lost, based on the file contents, it is possible to copy certain file types to a new folder.

First, get a list of all file types:

find ./lost+found -exec file -b {} \; > filetypes.txt

Looking into that file, you get a feeling for what it was what was stored on the file server. Sort and remove duplicates:

cat filetypes.txt | sort | uniq > filetypes_uniq.txt

Now you know what to look for.

Recovery

Copy and paste the following script to find.sh, then chmod +x find.sh

#!/bin/bash
# Script to copy files based on filetypes, eg. from lost+found
#
# Usage:
# Edit SOURCE and TARGET folders below, then
# ./find.sh filetype
#
 
# where to copy from (SOURCE) and copy to (TARGET). TARGET will be created if non existing
SOURCE="/home/jane/lost+found"
TARGET="/home/jane/recover"
 
# file name prefix "#"
FPREFIX="#"
 
# minimum filesize
FSIZE="100k"
 
if [ arg$1 != arg ]; then
  filetype=$1
else
  echo "Error: no filetype specified"
  echo "Usage: $0 [filetype]"
  exit
fi
 
# file extension
fext=".`echo $filetype |tr "[:upper:]" "[:lower:]"`"
 
# create target folder
targetfolder=$TARGET/$filetype
mkdir -p $targetfolder
 
FILES=`find "${SOURCE}" -name "${FPREFIX}*" -size +${FSIZE} -exec ls {} \;`
for file in $FILES
do
 
  fname=`basename "$file"`
  targetfile=${targetfolder}/${fname}${fext}
  check=`file "${file}" | grep -q "${filetype}"`
 
  if [[ $? -eq 0 ]]
  then
    echo "${file} is ${filetype}, copying to ${targetfile}"
    cp "$file" "$targetfile"
  fi
 
done

Examples

Using this script, it is possible to recover files based on what “file” thinks it is. For example to recover all MP3 sound files, use:

./find.sh MP3

After a while, you'll find your legally ripped MP3 files in the specified TARGET-folder/MP3/. They now have a .mp3 extension, but still are numerically named. If you have tagged them properly, you can easily rename them with a tagging application. I recommend exfalso.

To recover JPGs, use:

./find.sh JPEG

Other promising file types to try are MPEG, PNG, GIF, TIFF, TrueType, ZIP, CD-ROM filesystem, gzip etc.

Comments

DJKR, 2012-04-05 07:59

Thank you so much for this script, I had around 60GB of files in the lost+found folder, which consisted of MPEG/JPEG/ISO/AVI. This really helped me to recover the files into different folders for different filetypes. I was then able to reconstruct the MP3 filenames using the ID3 filenames and as for the photos I was able to split them up into folders based on the dates.

Enter your comment:
 
  • Bookmark "Recover files from lost+found" at Google
  • Bookmark "Recover files from lost+found" at Facebook
  • Bookmark "Recover files from lost+found" at Twitter
notes/recovery.txt · Last modified: 2013-03-03 12:30 (external edit)