Hi,
Yesterday I was forced to hard reboot my Linux and when it passed through e2fsck it showed errors in lots of inodes. After going through fsck(where all I did is choose default answer) when I checked lost+found there were around 1200 files of size 4GB(HD space is 8GB). 'ls -l' doesnt show type of the file(it shows '?' question mark). Now if I try to remove those files it says 'Operation not permitted'. I also tried 'chmod 644' but that too fails. So now what are theses files? How do I remove these files? lost+found also shows several block and character devices, I was unable to remove those too. Is there a separate command say 'rmnod' to remove such files?
Also my harddisk is NOW showing 1GB free, as far as I knew it only had 200MB space left, does it mean I have lost the files? Can this happen? I was under impression that any unattached inodes go to lost+found. Also there can't be 800MB of data open at time of reboot that all get corrupted and lost. But suprisingly all daily operations seem to be working fine. So point is where did free space come from? What files were lost? How do I find?
I am totally lost :-)
Thanks for help. Amish.
P.S. Kernel version is 2.2.17 and I am using the machine since 2 yrs and is reasonably stable.
Sometime Today, Amish Mehta assembled some asciibets to say:
Yesterday I was forced to hard reboot my Linux and when it passed through e2fsck it showed errors in lots of inodes. After going through fsck(where all I did is choose default answer) when I checked lost+found there were around 1200 files of size 4GB(HD space is 8GB). 'ls -l' doesnt show type of the file(it shows '?' question mark). Now if I try to remove those files it says 'Operation not permitted'. I also tried 'chmod 644' but that too fails. So now what
post a sample listing of the files. To figure out the file type, use the `file' command.
Also my harddisk is NOW showing 1GB free, as far as I knew it only had 200MB space left, does it mean I have lost the files? Can this happen? I was under impression that any unattached inodes go to lost+found. Also there can't be 800MB of data open at time of reboot
It is possible that a directory's inode was corrupted, so all files in there have gone to lost+found.
P.S. Kernel version is 2.2.17 and I am using the machine since 2 yrs and is reasonably stable.
I had a similar problem when I had 2.2.17, but was able to recover all my files - at least those that I wanted. In my case, the files showed correct attributes, only names had been changed. Files inside lost directories retained their original names (or I'd have had a hard time rebuilding those trees).
Philip
Amish Mehta (Sent: Saturday, December 29, 2001 7:53 AM) keys in:
when I checked lost+found there were around 1200 files of size 4GB(HD space is 8GB). 'ls -l' doesnt show type of the file(it shows '?' question mark) I try to remove those files it says but that too fails.
I remember such an instance which happened with me last year. I was using TurboLinux 6.0 and it had one of those 2.2.13/5/7 kernels.
/lost+found also shows several block and character devices So what are theses files? How do I remove these files?
I didn't get a messed up /lost+found, but I did get character/block devices in my data-directories. The file names are probably just placeholders. You will need a filesystem guru to attempt recovering data from that.
does it mean I have lost the files? What files were lost? How do I find?
Yes. You _have_ lost files amounting to the extra free space which you are observing.
suprisingly all daily operations seem to be working fine.
You haven't mentioned if you have separate partitions such as /usr /var, but that can be safely assumed, I guess. As long as you are not using any data/executables/libraries/whatever from the partition which is corrupted, you won't notice any change in daily operations.
To summarize, there has been some amazing screw-up somewhere in the filesystem data-structures. e2fsck wouldn't be able to find any inconsistency with it even if you run it again. So, the best thing you can do is to take a backup of whatever data you still have on the partition, format it and then reuse it.
If possible, get the latest stable kernel version (2.4.16?) and use it. :-)
-
ambarish pathak -
Amish Mehta -
Philip S Tellis