0

TL;DR: Formatted an external hard drive with ext4 filesystem, repaired it using fsck, and have a lost+found directory on it with thousands of unneeded files. I know that lost+found can't be deleted, but how do I get rid of these unneeded files and make sure that fsck does not repopulate these same files again on reboot?


I have already read through the following relevant links:

but was not able to find a solution to my problem.


I bought a new drive and loaded a couple GB of data onto it, but wanted to start from scratch again so I deleted all of the files on the drive through $ rm -rf ./*. I then noticed that this drive was formatted as a FAT drive and I wanted an ext4 partition only, so I used parted to format the drive (/dev/sda):

$ sudo parted /dev/sda
(parted) p
<some output indicating 2 partitions on the drive>
(parted) rm 1
(parted) rm 2
(parted) p
<I verify that there are no more partitions>
(parted) mklabel gpt
<parted tells me that there's an existing filesystem that will be overwritten and I confirm>
(parted) mkpart primary ext4 0% 100%
<confirmation stuff as well>
(parted) p
<verify that all is as it should be... or so I thought>
(parted) q

After quitting and trying to mount the device, I could not mount the new partition. Upon checking the filesystem, I saw that the partition was corrupted and tried $ sudo fsck -y /dev/sda1 (sda1 is the new, sole partition on the drive, formatted as ext4). This went through and formatted my partition as ext2, so I went back and repeated the reformatting steps using parted and tried $ sudo fsck -yt ext4 /dev/sda1 and it seemed to work well enough.

I could now mount the filesystem and it remained ext4. However, there is a lost+found directory with thousands of files within it now sitting in the drive. It is owned by root:root and even with a $ sudo rm -rf lost+found, I cannot delete it. It keeps spitting out rm: cannot remove '#<name of file>': Operation not permitted for every file I attempt to remove. Neither chmod nor chown help in helping remove the files located within this lost+found directory.

I then tried $ sudo su so I could # cd lost+found and check the attributes of the files with # lsattr but I still, even as root, get lsattr: Operation not supported While reading flags on ./#<name of the file>.

I have no need for any files on the system. I was toying around with rsync between my local machine and host and those are all of the files that I deleted. I know I don't need any of them (I have other backups in addition to all of those files present on my local machine) so I just want to get rid of this darned lost+found directory but it's being quite stubborn.


So, with all of that said:

What should I do? What are my next steps? Is there any more information I should provide from program output that could help figure this out?

Would it be easier to just format the drive again? I tried doing so twice already, but each time it will not mount without an $ fsck -t ext4 /dev/sda1 (I include the -y flag in there as well since I don't want to sit through the millions of confirmations it requires) and I end up here once again. I know that these lost+found files are being generated by the fsck program since I passed the -y option to it: there are parts of the output where it specifies that "there is existing data on the drive and it could be recovered, so should fsck move these files to lost+found?" and it automatically gets passed an affirmative so the directory gets created and populated with these thousands of files. Is it because I specify this partition as a primary partition? Should it be extended instead (only holding data files)?

Any help would be appreciated! Though the files don't take up much space on the hard drive (~1%), I would appreciate help in figuring this out since I want to understand why even root cannot delete these files and what I'm doing so horribly wrong in formatting my drives that I end up here every time.


Edits:

After logging in as root through $ sudo su, I could view the files within lost+found and tried to test the lost+found directory itself for processes that were locking the directory and the first file that was in the directory as well to see if anything was using it:

$ sudo su
# lsof lost+found
<no output>
# fuser lost+found
<no output>
# lsof lost+found/#51817
<no output>
# fuser lost+found/#51817
<no output>

Doesn't look like any other processes are locking these files. Upon examining with # lsattr, there are a couple files with the i flag, but there are many more without that flag.

Furthermore, as @PabloBianchi pointed out in the comments, since ext*-formatted filesystems will always have a lost+found directory, I have clarified the question by modifying the title: instead of deleting said directory, how can I clear it so the files I know I don't need to recover don't waste space on my drive?

  • After creating the partition, did you ever make a filesystem on it? That is usually a separate step after you partition the drive, using something like mkfs.ext4 etc. – ubfan1 Mar 1 '18 at 1:50
  • As you may know, if it is formatted with ext*, then lost+found it's supposed to be there. fsck will create it on next boot, or you can also with mklost+found. I would try with lsof and fsuer if root itself lock them, or check with lsattr if somehow "i" flag is set. – Pablo Bianchi Mar 1 '18 at 2:02
  • @ubfan1: I believe the mkpart primary ext4 0% 100% command while running parted would make the filesystem, right? As per the parted man page, the format of the command would be: mkpart part-type [fs-type] start end. – rainingimpala Mar 1 '18 at 2:11
  • @PabloBianchi Thanks for those tips! I have edited the post with the outputs from those commands. In summary, it doesn't look like any process is using the files. There are a couple files with the i flag, but many more without it. I am aware that lost+found is supposed to exist on any ext* filesystem, but I would like to purge these unneeded partially recovered files to make sure that they neither take up unnecessary space. – rainingimpala Mar 1 '18 at 2:22
0

Making a partition of type ext4 does not put an ext4 filesystem onto the partition. What you got was probably leftover stuff/junk from the previous filesystem. After you make the partition, put a filesystem on it with:

sudo mkfs.ext4 /dev/sda1

That should be an empty filesystem with only the empty lost+found directory on it.

  • You're right; that fixed it! Thank you for pointing out that there is a difference between making a partition of type ext4 and creating an ext4 filesystem on the partition. I had assumed that they were equivalent. – rainingimpala Mar 1 '18 at 3:42
  • Making a partition with the ext4 signature simply means that you're writing the signature in the partition table of the disk to inform the OS that an ext4 partition is at that location. Formatting the partition actually performs the formatting operation to the corresponding sectors in that partition, which also updates the signature in the process. – mmstick Mar 1 '18 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.