On 9/5/23 15:41, Rudolf Leitgeb wrote:
On Tue, 2023-09-05 at 14:16 -0400, John Holland wrote:
So this gave me the list of the files with what they seem to be in
groups. I think a lot of them are browser cache, jpegs, pngs....I
looked
at some of the gzipped ones and they were web pages and css files.
There are some that don't make sense, for instance #16251989 is
listed
as "ISO Media " and contains binary data and then some HTML.
So: great surprise, most of these lost+found files are browser cache
stuff, which was created just before the big crash. This is the kind of
stuff which hasn't been written to disk yet. It's extremely unlikely,
that you'll find a file in lost+found, which you haven't touched in
jours/days before the crash.
I would suggest, you ignore this lost+found directory for now, and only
if you can't find some important data you can search this directory
based on strings which should be in the missing file.
Maybe that's, why OpenBSD never cared about a journaling FS ...
What I've done to recover filenames, etc.
restore your backup somewhere
doas find <somewhere> -type f -exec cksum {} + > sums.restored
doas find <damaged> -type f -exec cksum {} + > sums.damaged
munge with sed, awk, uniq & friends
-> list of undamaged files
-> list of possible undamaged files in orphan directories
-> list of new? files & clues to where they lived
then
file &c on interesting orphans
Not necessarily quick but as Mr. Leitgeb suggests this should give
a very strong clue as to which files are caches and thus ignorable and
where the orphaned files should live
There have been studies about typical lifetimes of files.
IIRC there's a glob of short-lived browser, object, temp etc. files
There's another glob of system, etc files updated regularly but
infrequently.
Most live for weeks to years.
A cron job which does hierarchical dumps daily, weekly, etc. and sent
offline might help.
