How to manage iNode files in the “lost+found” directory

HardDriveIconXIf you open your Mac’s boot drive, you may find a folder called “lost+found” next to the System, Applications, Users, and other system directories at the top level of the drive. If not, then this folder may still be present, but could just be hidden, so check for its presence by pressing Shift-Command-G in the Finder, and then entering “/lost+found” (minus the quotes) in the drop-down panel. If this reveals the folder, you may find a number of files in it that begin with the name “iNode” and end with a series of numbers.

If you cannot locate this folder on your drive, then everything is well with your system; however, if the folder is present and has these files in it, then you may be experiencing hard drive problems. For one, these files may take up significant space on your hard drive, but also indicate mishandling of your filesystem structure.

Objects on your filesystem are called inodes, and can be either files or folders. A chunk of stored data on your hard drive is represented by a file inode, and is associated with a specific name and location (path) in the filesystem’s structure. However, problems such as a forced reboot during file access, or damage to your filesystem may result in the system losing track of an inode, especially if the inode is being interacted with when the problem occurs. When this happens, filesystem checking routines in OS X will detect the lost inode and restore it to the lost+found folder as an extensible archive file. The archives are then associated with the filesystem, and can be accessed for any data they contain.

Lost+Found inodes in OS X

iNode####### files will appear in the lost+found folder after the system detects inconsistencies in the filesystem.

Since these files are just archives, you can read their contents using basic Terminal commands:

  1. Open the OS X Terminal
  2. Run the following command to list the specified archive file’s contents (replace ####### with the numbers in the archive’s name):
    xar -tf /lost+found/iNode#######
  3. Press Enter to view the file’s contents.

At this point, you may see a massive number of files listed, but should be able to scroll up and determine what the content of the files is. If needed, you can extract the archive by running the following command:

xar -xf /lost+found/iNode#######

After your cursor is dropped back to the command prompt, you can go to the lost+found folder (as described previously) and then drag the extracted archive’s contents to more relevant locations on your drive, and make use of them as you will.

If you find you do not need the files’ contents, then you can safely remove the file, or the entire lost+found folder. If future filesystem checks find problems, then the folder will reappear and you can similarly check it out.

Viewing iNode files in the lost+found directory

In the terminal, first switch to the lost+found directory, then use the “file” command (second arrow) to confirm the files are archives, and then use the “xar” command to view the file’s contents. In this case, the iNode file is a rogue OS X installer application, which can be discarded.

Generally, the lost+found folder on your drive will appear if filesystem inconsistencies are found, which may happen when the system boots after a power failure, hard shutoff, or similar reset. After such events, the system is expected to manage inconsistent files, but if the lost+found folder keeps reappearing and you see multiple files showing up in it, then you are very likely experiencing a filesystem problem that will require you immediately back up your drive, format it, and restore OS X. In general, such problems cannot be fixed by simply running a filesystem check or repair, and the more interaction you do to your drive, the more chances you have for the damage to affect the files on it.

7 thoughts on “How to manage iNode files in the “lost+found” directory

  1. xAirbusdriver

    OK. I found the same list of “Resources” on my wife’s MBP. They all seem to be language “.lproj”, “Localizable.strings”, and “VolumeCheck.strings” probably for every language Apple installs by default. All related to the “InstallMacOSX.pkg”. These may have been created back in July of last year when I finally installed Mavericks on her machine. (Rule #1: Don’t ‘mess’ with the wife’s computer OS unless it’s been throughly “Zeta” tested!!! Rule #2: See Rule #1.).

    I don’t think there will be any harm in simply deleting these files and even the directory. I think they were only installed/used/”lost” on the last OS Install. She certainly has no shortage of ‘language’ files! 😉

  2. MaX

    What about the ones in Time Machine drives? Can they be fixed with applications like DiskWarrior?

    1. B. Jefferson Le Blanc

      Why not try it and let us know? You’ll need the latest version of DiskWarrior (version 5) if your Time Machine backup contains more than 2TB of data. You’ll probably need to let it run overnight as Time Machine backups contain many millions of files.

  3. joshua p

    Thank you as well. Absolutely helped me understand what was in the lost and found and make space.

  4. Oliver – WebMatros

    Great guide. Thank you. In my case it was the latest OS image + some language resources for languages I don’t need.

    Nice to know I can safely get rid of it, which will let me easily see if new problems arise, since there’ll be a new lost+found folder, if that’s the case:)

    Oliver

Comments are closed.