Big iNode file in lost+found

its most likely OSX installer..run it and confirm that it is. Afterwards its upto you if you want to keep it or delete it. Later works just fine and frees up a chunk of space.

A 4.35GB iNode file is most likely the Mountain Lion installer. Mine is. I'm going to go ahead and trash it.

The iNode file is what is left over after the fscheck (disk repair) does its job. It is usually an orphaned block of data (inode) that was not properly dereferenced when a file was deleted. Inodes in general are low level data structures, however, a file named iNode is no more low-level than any other file. The disk repair utility finds these orphaned data chunks, dereferences them, but saves a copy in the lost+found just in case they contain important data and the used had tried to brute-force cancel an unintended delete. If not needed, these files can be safely deleted.

In this case, Finder or the AppStore app had most likely crashed or had to be force quit while in the process of deleting the file after the successful OS upgrade.

In my case my iNode file has 4172M, and is an archived volume named "Mac OS X Install ESD", containing

the folders "Install OS X Mountain Lion.app", "Library", "Packages", "System" plus a whole bunch of hidden files.

Well smiff, couldn't the x in xar refer to the x in OSX? I am quite sure an OS run by an Apple device would NOT use a MS-Office file type for documentation. Sounds odd...

You are right that the mystery file has nothing to do with MS Excel.

Click on the search icon on the OS X menu bar (the magnifying glas at the right), type "terminal" without the quotes. Click on the application called Terminal. Once the Terminal window opens, type the following: "man xar", without the quotes, then press enter. You will be presented with the system manual for the archiver called xar. Use the up/down arrows to scroll, or press "q" to exit.

Reading through that documentation it should become obvious that xar is a file archive/compression format similar to the popular ZIP. The unknown file is the downloaded OS X upgrade packed in the xar format.

"DESCRIPTION

The XAR project aims to provide an easily extensible archive format.

Important design decisions include an easily extensible XML table of

contents (TOC) for random access to archived files, storing the TOC at

the beginning of the archive to allow for efficient handling of

streamed archives, the ability to handle files of arbitrarily large

sizes, the ability to choose independent encodings for individual files

in the archive, the ability to store checksums for individual files in

both compressed and uncompressed form, and the ability to query the ta-

ble of content's rich meta-data."

I had 2 of these large files. I did control-click --> Open with --> DiskImageMounter.app, and discovered that they appeared to be the Lion and Mountain Lion install files (I now run Mavericks). I deleted both, freeing up nearly 8 gb, and all seems well so far.

My iNode6689314 file is 5,29GB and created 23 of Oct this year. That aught to be when I installed Mavericks.

On macrumors Bernuli posts that

What you see in lost+found is the result of a filesystem check, or Disk First Aid running and finding a some things out of alignment. Not a big deal, unless you have a bazillion of those files. Then you should find out what is causing it.

Full thread

That seems likely in my case.

I found this thread after discovering 5GB of file in /lost+found/

lost+found is simply a place that the filesystem checking utility dumps data it finds "unusually", just in case that data can be recovered. Practically, it happens when machines crash or are powered off unexpectedly.

If you run "file /lost+found/iNode*" you may find it is an xar archive, which can be inspected using "xar -t -f <filename>" and on my system this was rather obviously the Mac OS X installer.

The file contains data which were orphaned on your filesystem. It most likely happened during a delete as the system crashed or powered off. It's very unlikely you will need or miss those data.

Delete the file. If it appears again when you next boot, boot to the installer and repair the disk.

I just updated daughter's macbook pro. using the daisy disk....I found 3 of these inodes lost+found that equals to 14.8 GB. that's alot of space.

in simple man terms what do I do? thanks

I had two of these files. I was using Disk Inventory X to find out why I ran out of disk space. I opened Disk Utility and dragged one of the files in. I then clicked open image and after a minute or so it showed that it was OSX Installer.

Both were named "OS X Install ESD" (I took a screenshot before the second one finished mounting).

I moved both of them to the trash and it prompted me to authenticate. Afterwards I restarted and everything booted up fine. I then emptied the trash and restarted again. Everything is still working fine and I have 10 GB of disk space back. Thanks!

.xar is an archive format: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/ man1/xar.1.html

I first ran "file" to check it:

> file iNode38857788

iNode38857788: xar archive - version 1

Then I ran "xar -t" on the file and got:

/lost+found > xar -t -f iNode38857788

Distribution

InstallMacOSX.pkg

InstallMacOSX.pkg/Bom

InstallMacOSX.pkg/Payload

InstallMacOSX.pkg/Scripts

InstallMacOSX.pkg/PackageInfo

InstallMacOSX.pkg/InstallESD.dmg

Resources

Resources/ar.lproj

Resources/ar.lproj/Localizable.strings

Resources/ar.lproj/VolumeCheck.strings

Resources/ca.lproj

... etc ...

I found this on the

. it is the most complete reference I have found. It talks about the enclosed inode file, how it likely got there, how to check it and gives some indications on whether can be safely deleted or not.

http://www.macissues.com/2015/08/20/how-to-manage-inode-files-in-the-lostfound-d irectory/

Gives you all the information you need on managing inodes

I also did

cd /lost+found

xar -f iNode17698873 -t

and found that the contents of the archive was

Distribution

InstallMacOSX.pkg

InstallMacOSX.pkg/Bom

InstallMacOSX.pkg/Payload

InstallMacOSX.pkg/Scripts

InstallMacOSX.pkg/PackageInfo

InstallMacOSX.pkg/InstallESD.dmg

Resources

Resources/ar.lproj

Resources/ar.lproj/Localizable.strings

..... more resoures/.... stuff

So I did

sudo mv iNode17698873 ~/Desktop/.

And restarted my computer.

My computer works fine and I saved ~4 GB. So then I safely deleted iNode17698873 and restarted just fine

Thank you, sounds like sound advice, I will try this now, if it works you just gave me 15GB!