====== Recover files from lost+found ======

You know the feeling: you are beavering away with whatever it is what you're doing and suddenly, you are confronted with a hard disk failure in your file server. In a brave attempt to get the failing partition at least mountable again, you unmount it and let e2fsck do its magic:

  # e2fsck -p /dev/sde1

All well and done, the partition is mountable again. But everyhing is not back to normal, you discover only a single folder: "lost+found". Looking into this folder, it seems that there are tons of files with a numeric filename, //all in one single folder//. GBs worth of finely assorted data turned into an undistinguishable mess. Great.



===== What next? =====

But it's not all lost, based on the file contents, it is possible to copy certain file types to a new folder.

First, get a list of all file types:

  find ./lost+found -exec file -b {} \; > filetypes.txt

Looking into that file, you get a feeling for what it was what was stored on the file server. Sort and remove duplicates:

  cat filetypes.txt | sort | uniq > filetypes_uniq.txt

Now you know what to look for. 




===== Recovery =====

Copy and paste the following script to find.sh, then chmod +x find.sh

<code bash>
#!/bin/bash
# Script to copy files based on filetypes, eg. from lost+found
#
# Usage:
# Edit SOURCE and TARGET folders below, then
# ./find.sh filetype
#

# where to copy from (SOURCE) and copy to (TARGET). TARGET will be created if non existing
SOURCE="/home/jane/lost+found"
TARGET="/home/jane/recover"

# file name prefix "#"
FPREFIX="#"

# minimum filesize
FSIZE="100k"

if [ arg$1 != arg ]; then
  filetype=$1
else
  echo "Error: no filetype specified"
  echo "Usage: $0 [filetype]"
  exit
fi

# file extension
fext=".`echo $filetype |tr "[:upper:]" "[:lower:]"`"

# create target folder
targetfolder=$TARGET/$filetype
mkdir -p $targetfolder

FILES=`find "${SOURCE}" -name "${FPREFIX}*" -size +${FSIZE} -exec ls {} \;`
for file in $FILES
do

  fname=`basename "$file"`
  targetfile=${targetfolder}/${fname}${fext}
  check=`file "${file}" | grep -q "${filetype}"`

  if [[ $? -eq 0 ]]
  then
    echo "${file} is ${filetype}, copying to ${targetfile}"
    cp "$file" "$targetfile"
  fi

done
</code>


===== Examples =====

Using this script, it is possible to recover files based on what "file" thinks it is. For example to recover all MP3 sound files, use:

  ./find.sh MP3

After a while, you'll find your legally ripped MP3 files in the specified TARGET-folder/MP3/. They now have a .mp3 extension, but still are numerically named. If you have tagged them properly, you can easily rename them with a tagging application. I recommend [[http://www.sacredchao.net/quodlibet|exfalso]].


To recover JPGs, use:

  ./find.sh JPEG

Other promising file types to try are MPEG, PNG, GIF, TIFF, TrueType, ZIP, CD-ROM filesystem, gzip etc. 

~~DISCUSSION:closed|Comments~~