What lost+found Actually Does on ext Filesystems

The /lost+found directory exists so that fsck has somewhere to put orphaned data it recovers during a filesystem check. When the kernel panics or the power cuts out, files that were unlinked but still held open by a process can leave behind inodes with no directory entry pointing at them. fsck salvages those inodes, but since the original name and path are gone, it dumps them into lost+found keyed by inode number for the administrator to sort through.

The directory is specific to the ext2/3/4 family (and historically BSD’s UFS), and it preallocates space so fsck has room to write directory entries even on a full disk. Most of the time it stays empty, and entries that do appear after a crash are usually files that were already being deleted anyway. After serious corruption, though, it can be the only path back to recoverable data — incomplete and possibly stale, but better than nothing.

If you delete it by accident, recreate it with mklost+found rather than mkdir so the preallocation is restored; otherwise fsck will rebuild it on the next clean boot.