Table of Contents

Recover files from lost+found

You know the feeling: you are beavering away with whatever it is what you're doing and suddenly, you are confronted with a hard disk failure in your file server. In a brave attempt to get the failing partition at least mountable again, you unmount it and let e2fsck do its magic: 

# e2fsck -p /dev/sde1

All well and done, the partition is mountable again. But everyhing is not back to normal, you discover only a single folder: “lost+found”. Looking into this folder, it seems that there are tons of files with a numeric filename, all in one single folder. GBs worth of finely assorted data turned into an undistinguishable mess. Great.

What next?

But it's not all lost, based on the file contents, it is possible to copy certain file types to a new folder.

First, get a list of all file types: 

find ./lost+found -exec file -b {} \; > filetypes.txt

Looking into that file, you get a feeling for what it was what was stored on the file server. Sort and remove duplicates: 

cat filetypes.txt | sort | uniq > filetypes_uniq.txt

Now you know what to look for.

Recovery

Copy and paste the following script to find.sh, then chmod +x find.sh 

#!/bin/bash
# Script to copy files based on filetypes, eg. from lost+found
#
# Usage:
# Edit SOURCE and TARGET folders below, then
# ./find.sh filetype
#
 
# where to copy from (SOURCE) and copy to (TARGET). TARGET will be created if non existing
SOURCE="/home/jane/lost+found"
TARGET="/home/jane/recover"
 
# file name prefix "#"
FPREFIX="#"
 
# minimum filesize
FSIZE="100k"
 
if [ arg$1 != arg ]; then
  filetype=$1
else
  echo "Error: no filetype specified"
  echo "Usage: $0 [filetype]"
  exit
fi
 
# file extension
fext=".`echo $filetype |tr "[:upper:]" "[:lower:]"`"
 
# create target folder
targetfolder=$TARGET/$filetype
mkdir -p $targetfolder
 
FILES=`find "${SOURCE}" -name "${FPREFIX}*" -size +${FSIZE} -exec ls {} \;`
for file in $FILES
do
 
  fname=`basename "$file"`
  targetfile=${targetfolder}/${fname}${fext}
  check=`file "${file}" | grep -q "${filetype}"`
 
  if [[ $? -eq 0 ]]
  then
    echo "${file} is ${filetype}, copying to ${targetfile}"
    cp "$file" "$targetfile"
  fi
 
done

Examples

Using this script, it is possible to recover files based on what “file” thinks it is. For example to recover all MP3 sound files, use: 

./find.sh MP3

After a while, you'll find your legally ripped MP3 files in the specified TARGET-folder/MP3/. They now have a .mp3 extension, but still are numerically named. If you have tagged them properly, you can easily rename them with a tagging application. I recommend exfalso.

To recover JPGs, use: 

./find.sh JPEG

Other promising file types to try are MPEG, PNG, GIF, TIFF, TrueType, ZIP, CD-ROM filesystem, gzip etc.