Data Recovery Digest

In Linux and Unix operating systems, there is a folder at the root called /lost+found. This is a special folder created and used by the system and is used to store bits of data that are “unlinked” from the file system. These will appear in the lost+found folder after a fsck (file system check) is performed. From there, you can review them and determine what to do with them.
From this description, lost+found sounds rather similar to two things: the Trash Bin and the results of a data recovery operation. However, lost+found is unique from both of these. Unlike the Trash Bin, items in the lost+found folder were not necessarily deleted, though occasionally, files that were deleted may end up in there. Unlike the results of a data recovery analysis, lost+found files are gleaned when a fsck is performed from a working logical volume, whereas data recovery is often done on formatted or corrupted disks. There are certain implications to this which will be explained further below.
How Lost+Found Works
When you run fsck on a volume, it may find fragments of data that are not referenced somewhere else in the file system. Most often, fsck finds inodes with no corresponding file names—that is, data that looks like it could be a complete, intact file that does not have a name on the system. This data will be occupying disk space on the drive, but it won’t be accessible by normal means.
When fsck repairs the file system, these files willb e moved into the lost+found folder and given a provisional file name. Upon review, you’ll often find that these were temporary files or files that were slated for deletion but were still being used by a process when the system halted. This will happen during a kernel panic or power failure. Files may show up in lost+found because the file system was corrupted due to a software bug. In this case, the files may not be intact.
Note that if you accidentally delete lost+found, you can recreate it using the mklost+found command.

How Data Recovery Works
Whereas lost+found is run on a relatively healthy partition, data recovery searches for “lost” files that are still occupying space on a disk that may not be accessible at all. For example, if the entire disk has been reformatted or the master boot record has been corrupted. Similar to lost+found, data recovery will analyze and organize data that looks like entire files. But it may also be able to recover files with file names and directory paths still intact.

When to Use fsck and When to Use Data Recovery
If you’ve accidentally deleted a file, or if you’ve lost a file due to a virus attack or file system corruption, use data recovery first. Whenever you make changes to the data on a drive, it reduces your chances of recovering the data, since it may become overwritten. Running a fsck may recover lost files, but it will certainly write new data, which is not what you want to do at this point. The role of fsck isn’t to recover lost files—the fact that it does this is ancillary to its main function, which is to check and repair the file system.
Your safest bet is to dismount the drive where the lost file resided and then mount it as a read only drive from another host operating system. Run the data recovery on the disk and save the files to another drive.