File System Checking

Performing a filesystem check

You can use the fsck(8) command as root to check and repair filesystems.

The file system checker or fsck, can peform both physical and non-physical checks on a filesystem. The default is to do a non-physical check on the filesystem structures. The -c option performs a physical, non-destructive check in addition to the normal filesystem check.

The physical check utilises the badblocks program to find all the logical filesystem blocks that are damaged (contain bad sectors), and mark them off in the filesystem so that they are not used for storing datablocks.

The bad blocks will be allocated to inode number 1 on the relevant filesystem. This inode has no corresponding filename in any directory in the filesystem, hence you cannot get hold of it.

You must un-mount a filesystem before you can check it, except the root filesystem, which can never be un-mounted. To check the root filesystem ensure that you are in single user mode (run level 1 or s), this will ensure that there are no processes from multi-user mode writing to the disk when you do the check.

Lost+found directory

When a file is saved, data blocks are allocated to it for the file data, an inode is allocated to describe that file, and a new directory entry is made in the directory that contains the file. The directory entry consists of a filename and a matching inode number (and depending on the filesystem possibly more information). Setting up the directory entry is the last operation performed in this sequence.

In the event of an improper shutdown, such as a power failure or system hang, it is possible that a file that has been saved will have its data blocks allocated, an inode, but the directory entry will not yet have been written to disk. This is the most common form of filesystem corruption.

To fix this problem, when fsck is run and it finds such files without filenames in the filesystem it has essentially found a lost file it now has to give it a new filename, essentially reconnecting it to the filesystem directory structure. Fsck will create a new filename entry for the lost file in the filesystems' lost+found directory, which is located in the root directory of the filesystem. Fsck will create this directory if it does not exist fsck will name the file after the inode number.

Different Unix systems may have slightly different symantics here. On Linux, fsck will construct the filename of a lost file has a # character followed by the inode number. For example, if fsck finds a lost file in the root filesystem that has the inode number of 2105, then the repaired file will be called "/lost+found/#2105".