Re: Renaming lost+found

On Sun, Jan 28, 2001 at 01:35:44PM -0800, H. Peter Anvin wrote:
> *renamed*, i.e. does the tools (e2fsck &c) use "/lost+found" by name,
> or by inode?  As far as I know it always uses the same inode number

e2fsck uses /lost+found by name, not by inode.  It will recreate a new
lost+found directory if one doesn't exist.  *However*, if the
filesystem is badly corrupted, it's possible that when it allocates
blocks for the lost+found directory, it might override a datablock
that might possibly be recoverable if one were truly desparate and
using a disk editor to search for keywords.  (This would only happen
if part of the inode table had gotten corrupted due to a hardware
error --- i.e., such as the anecdotal evidence of DMA units that write
garbage to the disk because during a power failure, where it is
conjectured that the +5V power rail drops below the critical working
of the memory faster than +12V power rail drops below the critical
working volutage of the disk drive --- so that the record in the inode
table that a certain disk block was in use is erased.)

So if you really dislike lost+found, go ahead and delete it.  It
removes a somewhat tiny safeguard, but being able to take advantage of
it requires wizard-level skills (there are no tools to do this
automatically, since it requires human intuition and a knowledge of
what file you might be trying to save.)  So it would probably only be
used in the case of someone who had 10 year's of Ph.D. research that
wasn't backed up, and this was the only way they could get the data
back.  And although not doing disk backups is grounds for general
redicule, losing ten years of graduate research would probably be
reguarded by most as cruel and unusual punishment.  But if you're not
in a Ph.D. program, it doesn't matter, yes?  (And in any case, we ALL
do backups, all the time, religiously and on a regular schedule,
RIGHT?  :-)

						- Ted