A manufacturer in Hinckley runs its design work on a Linux workstation with the models on a separate data disk. After an unplanned shutdown the machine checked the volume on the way back up, offered a series of questions nobody in the office understood, and was told yes to all of them. What came back was a working disk with a large part of the project tree missing and several thousand items sitting in a lost and found folder, each one named as a bare number.
| Media | A data disk from a Linux CAD workstation, checked automatically after an unplanned shutdown. Several thousand files now sit in a lost and found folder identified only by inode number, with their original names and folder structure gone. |
| What was reported | Workstation data disk, previously fine, some files no longer visible after a filesystem check, thousands of items now in lost and found labelled as inodes, models and drawings wanted back with their names and folders. |
| Fault class | Logical, and partly self-inflicted. The check found directory entries it could not reconcile and detached the files they pointed at, filing each one under its internal number. The file contents were never touched; the naming and the tree were what the repair discarded. |
| On the bench | Read behind a hardware write blocker so no further check could run, imaged in one pass on DeepSpar, the filesystem examined from the image in UFS Explorer with R-Studio used as a second reading, surviving directory blocks recovered and the journal replayed against them to match orphaned inodes back to their names and parents, remaining files identified from their own internal headers, and the rebuilt tree validated and written to fresh media. |
Lost and found is the tidy end of a filesystem check, not a fault of its own. Every file on this kind of volume has an internal record holding its content and its properties, and a separate directory entry holding its name and its place in the tree. When a check meets a file whose record is sound but whose directory entry has gone or does not agree, it has nowhere to put it, so it hangs it in one place under its record number so that nothing is lost.
The files are all present, which is why the disk looks fine and feels wrong. Open one of those numbered items and it is the drawing it always was. The office was not missing data; it was missing the ability to tell one of four thousand numbered items from another, which on a project tree of part revisions is the same thing in practice.
Answering yes to all of it was the expensive part. The check asks whether to clear entries it cannot make sense of, and clearing them is how the directory information was thrown away. On a disk with no backup that question should always be answered by stopping and taking a copy first. This is worth knowing in advance, because the check often runs automatically at boot and the questions arrive before anyone has had a chance to think.
The arrangement is recoverable more often than people assume. Directory information is stored in ordinary blocks, and blocks that have been detached are usually still sitting where they were until something overwrites them. The journal, which records recent changes so they can be replayed, frequently holds the missing links as well. Between the two, most names can be put back on most files, and where they cannot, a CAD file carries the part number in its own header.
The disk was write-blocked before anything else, which mattered more than usual here because the risk was another automatic check running and clearing more than the first one had. It imaged in a single pass with no bad regions; the surface had never been the problem.
UFS Explorer read the filesystem from the image, with R-Studio run over the same image as an independent second reading. Detached directory blocks were recovered from unallocated space and the journal was replayed against them, which restored names and parents for most of the orphaned records. The remainder were identified from the metadata inside the files themselves, since the design software writes the part number and revision into its own header. The rebuilt tree was checked against the office's own drawing register before being written to fresh media.
Around nine tenths of the tree came back with its original names and structure. Most of the rest were placed correctly using the part numbers inside the files, and a residue of about two hundred items went back as numbered files in their own folder, with the honest explanation that their names no longer existed anywhere to be recovered from.
One disk is £300 + VAT. This was logical work throughout, so no fix, no fee applied and the invoice followed once the drawing office had checked the rebuilt tree against its register.
Stop and take a copy first, even if the copy takes a day. A check that offers to clear entries it cannot understand is proposing to discard the only record of what your files were called and where they sat, and it makes that offer at the worst possible moment, usually during a boot when somebody wants the machine back. If it has already run and left you with a folder full of numbered items, do not run it again: the second pass has less to work with and can clear more. Do not move or rename the numbered files either, and do not write anything new to the volume, because the detached directory blocks holding the names are sitting in space the system now considers free.
Each of these is a real enquiry, taken from a household or a business somewhere in Leicester or the surrounding county, with the name of the customer, the firm and anything else that would identify them taken out. What is left is the reasoning: what turned up, what had actually failed inside it, the method that fault required and the equipment it was worked on. One of the thirty-six is a job that was refused, and it belongs here every bit as much as the successes do.
The format prompt is what a computer offers when it has run out of ways to read a volume
When every machine fails in the same way, the machines have already been ruled out
Doing nothing after a deletion is the most valuable thing an owner ever does
Examining it is free and takes 2 working days from arrival, the figure goes to you in writing and does not move afterwards, and a logical fault carries no fix, no fee. Start online or ring the freephone.