Re: Recovery binary from lost+found

On Sun, Dec 31, 2023 at 03:01:10PM +0100, Kirill A. Korinsky wrote:

>
> > On 31. Dec 2023, at 11:02, Otto Moerbeek <otto@drijf.net> wrote:
> >
> > Amongst other things, fsck_ffs(8) looks for inodes not mentioned in
> > any directory, i.e. files that are orphans. fsck_ffs links those files
> > into the lost+found dir, using the inode number for a name.
>
>
> sounds like just remove it and forgot, isn't it?
>
> >
> > Try to figure the contents of the file, using e.g. file(1) or
> > hexdump(1). On success, just move the files to the right place with
> > the right name. Often you'll find that those files are not longer
> > useful, in that case just remove them from lost+found.
>
>
> As was said before this is binary files:
>
> island# file *
> #1866245: ELF 64-bit LSB shared object, x86-64, version 1
> #2021828: ELF 64-bit LSB shared object, x86-64, version 1
> island#
>
> and it has quite different size:
>
> island# ls -la
> total 7912
> -r--r--r-- 1 root bin 3680832 Dec 31 00:30 #1866245
> -r--r--r-- 1 root bin 317600 Dec 31 00:30 #2021828
> drw------T 2 root wheel 512 Dec 31 01:10 .
> drwxr-xr-x 16 root wheel 512 Dec 31 01:27 ..
> island#
>
> an attempt to run it leads to crash, yes I've tried move to bin.
>
> --
> wbr, Kirill
>

There are toos like objdump and readelf that can tell you more, but
just removing them is likely best. Object files can always be
re-created on an open-source system.

-Otto