The Inode Rescue: Finding Lost Souls with Printf

When you run fsck on an ext2, ext3, or ext4 volume, orphaned inodes get dumped into a lost+found directory. The files land there with generic names like #12345, and you lose the original filename, owner, and permissions at a glance. The find command with its -printf flag lets you pull exactly the metadata you need in a clean, columnar format without reaching for ls or stat on every single file.

Basic syntax

The -printf option is a GNU find extension (not available on BSD find). You pass a format string that uses %-prefixed directives:

find . -printf '%u %f %p\n'

This prints the owning user, the bare filename, and the full path, one file per line.

Common printf switches

Auditing lost+found

A practical one-liner for getting a readable inventory of everything fsck recovered:

find /lost+found -printf "%s %m %u:%g %h %f\n"

Output looks something like this:

1048576 644 root:root /lost+found #12345
4096    755 www-data:www-data /lost+found #12346

From there you can sort by size, filter by owner, or pipe into awk to build a CSV for further analysis.

Tips

• Add -type f to skip directories if you only care about regular files.
• Use sort -rn on the size column to find the largest recovered files first.
• If you need the output in a fixed-width table, swap the space separators for tabs (\t) and pipe through column -t.

For the full list of available directives, check the man page:

man find

Look under the -printf section for every supported switch, including date formatting, device numbers, and inode information.

• SysAdmin

• Bash
• SysAdmin