Debian Linux: Simple steps to recover files from /lost+found

The following steps illustrate how one can use simple shell commands to recover files from the /lost+found directory in Linux. This assumes that you actually have some files in /lost+found.

1. First, concatenate all the *.md5sums files in /var/lib/dpkg/info into a single file:

   
   

   cd /var/lib/dpkg/info
   cat *.md5sums | sort -k 2 > /tmp/all.md5

   
   
   

2. Go to the /lost+found directory. fsck may have placed some files here after fixing the Linux partition. If you don't find any file here, you can relax and skip the following steps. Run md5sum on files in /lost+found.

   
   

   cd /lost+found
   md5sum * | sort > /tmp/lost.md5

   
   
   

3. Put only the md5sum values into a temporary file, called 0.txt.

   
   

   awk '{print $1}' /tmp/lost.md5 > /tmp/0.txt

   
   
   

4. Search all.md5 for the md5sum values in 0.txt and save the results in 1.txt.

   
   

   for f in $(cat /tmp/0.txt); do grep $f all.md5 >> /tmp/1.txt; done

   
   
   

5. Put the names of files in /lost+found into a temporary fie 2.txt.

   
   

   awk '{print $2}' /tmp/lost.md5 > /tmp/2.txt

   
   
   

6. Move the lost+found files to their original locations.

   
   

   cd /
   for $f in $(cat /tmp/2.txt); do MD5=$(grep $f /dev/shm/lost.md5 | awk '{print $1}'); ORIGIN=$(grep $MD5 /tmp/1.txt | awk '{print $2}'); mv /lost+found/$f /$ORIGIN; done