What happens if I delete lost+found

Question

When you create some Linux filesystems like ext3 a 'lost+found' directory is created. According to this files will be placed there if files where damaged from some kind of system crash.

What happens if this directory is removed, and the system crashes. If the folder is removed can I just create a new directory with mkdir lost+found or are there attributes that can only be set when the filesystem is being created.

Answer 1

fsck will recreate the lost+found directory if it is missing.

On startup most distributions run fsck if the filesystem is detected as not being unmounted cleanly. As fsck creates the lost+found directory if it is missing, it will create it then and place anything that it finds into that directory.

Answer 2

If you have no lost+found, e2fsck (I have not inspected the code to other fsck implementations) will offer to create it for you. But, you can recreate it yourself if you want, too; there's nothing particularly special about that directory (at least not from inspecting the code).

Answer 3

A pre-existing lost+found directory with a large enough size to contain a large number of unlinked files puts less of a burden on e2fsck to create the directory and grow it to the appropriate size.

It will still attempt to do so, but in the face of a corrupt filesystem, it can be more risky.

Very old fsck's for other filesystems on other platforms were not able to create /lost+found, nor were they able to grow it. This is the history for the rationale of /lost+found. But the current rationale is simply to make e2fsck's job easier.

Answer 4

You can create that directory just using mkdir. It should be owned by root, with a group of either root or wheel. Other than that there isn't anything especially special about it. In the event of a power failure or improper shutdown when the system boots it should automatically launch fsck. fsck will go through the system and try to recover any corrupt files that it finds. Any files that it comes across that are potentially corrupted will get moved there.

The other case for files to be moved there is if fsck finds a file whose's parent inode is missing. This is usually the case if a block gets corrupted on the disk in the specific location where a folder's inode is being stored. It will reassign their parent inode to be the lost+found folder.

Edit: I am unsure if the latter case will recreate the directory. I would leave it alone to be on the safe side. I can't think of any reason to delete it. Nothing bad will happen without it though.