Can you have multiple lost and found directories?
Why would you ever need to run this command?
In case the lost+found
directory doesn't exist. Since it's just an ordinary directory, the root
user can remove it using rm -r
. Some versions of fsck
, when they need to make use of a lost+found
directory, will create it if it doesn't exist, and some versions won't. If there's no lost+found
directory, fsck
can't recover orphaned files, that is, files that do not have any directory entries that refer to them.
The Linux version of mklost+found
has the following feature (from the mklost+found man page):
mklost+found
pre-allocates disk blocks to the lost+found directory so that when e2fsck(8) is being run to recover a filesystem, it does not need to allocate blocks in the filesystem to store a large number of unlinked files. This ensures that e2fsck will not have to allocate data blocks in the filesystem during recovery.
This means that, if you have to recover files from a damaged filesystem using fsck
, fewer files will be lost as part of the recovery process because fsck
won't need to allocate blocks from the filesystem; such blocks which may contain valid file data.
What would happen if you have multiple lost and found directories?
For a given filesystem, fsck
will only use one lost+found
directory: the one that is at the filesystem's root directory. Any other lost+found
directory will not be treated specially.
Q1. Why would you ever need to run this command? The lost+found directory already exists in / on every distro I've checked.
Something needs to create the lost+found
, this command would appear to do that. Every medium you mount needs to maintain its own lost+found
.
excerpt from man page
mklost+found is used to create a lost+found directory in the current working directory on a Linux second extended file system. There is normally a lost+found directory in the root directory of each filesystem.
What's the big deal with making a lost+found
directory?
mklost+found pre-allocates disk blocks to the lost+found directory so that when e2fsck(8) is being run to recover a filesystem, it does not need to allocate blocks in the filesystem to store a large number of unlinked files. This ensures that e2fsck will not have to allocate data blocks in the filesystem during recovery.
Q2. What would happen if you have multiple lost and found directories? Would recovered data fragments go to the lost+found dir in / , or would it go to the most recently created lost+found dir?
I would expect that the last one would be the one that gets used by e2fsck
if it needs to move data blocks to lost+found
.
"The lost+found directory already exists in /
on every distro I've checked."
But that's not the point. Every "real" filesystem (which maps to a block storage of some sort, as opposed to pseudo filesystems like /proc and swap) needs a lost+found orphanage. For example, if you have a separate filesystem for /home, then there should be /home/lost+found
. This is because fsck
won't move a file to /lost+found
on the root filesystem; it leaves the files it finds where it found them, but creates a directory entry in the orphanage so that a human can intervene to arrange for the appropriate adoption. Knowing that something is in /home/lost+found
vs. /var/lost+found
can make that manual intervention far easier.