ReverendFitty

Q: Big iNode file in lost+found

I recently went through a difficult install of Lion (Fried my RAM). I basically wiped my Hard Drive, installed clean from a thumb drive, created a new user profile, then used migration assistant to move my time machiene files and old user profile over. The only thing that went wrong with this was that my old migrated profile would crash upon start-up, but this went away once I let the system index with my new profile.

 

Cleaning up after this mess, I saw a lost+found folder was created, and an iNode was in there (iNode290815 to be precise). Read what this meant online, and ran disk repair. It seemed to fix whatever problems may have been left over from the install, but the iNode file is still there, and it's 3.6 gigs large. Since Disk Repair checked out, and everything has been running well, is this file ok to delete? I'd like the space back, if possible, or at least move it so its out of sight.

 

Thanks

MacBook Pro, Mac OS X (10.7)

Posted on Aug 8, 2011 6:29 PM

Close

Q: Big iNode file in lost+found

  • All replies
  • Helpful answers

Previous Page 2 of 3 last Next
  • by smiff,

    smiff smiff Oct 2, 2012 8:11 AM in response to macjack
    Level 1 (45 points)
    Oct 2, 2012 8:11 AM in response to macjack

    xar files CAN be Excel aut-recover files. Certainly not in my case though as I don't have Excel, but I do have a 4.35Gb iNode file in my lost+found.

  • by hadzee,

    hadzee hadzee Oct 2, 2012 10:13 AM in response to smiff
    Level 1 (0 points)
    Oct 2, 2012 10:13 AM in response to smiff

    its most likely OSX installer..run it and confirm that it is. Afterwards its upto you if you want to keep it or delete it. Later works just fine and frees up a chunk of space.

  • by internetpseudonym,

    internetpseudonym internetpseudonym Dec 4, 2012 9:22 PM in response to smiff
    Level 1 (0 points)
    Dec 4, 2012 9:22 PM in response to smiff

    A 4.35GB iNode file is most likely the Mountain Lion installer. Mine is. I'm going to go ahead and trash it.

  • by al p bundy,

    al p bundy al p bundy Feb 20, 2013 7:35 PM in response to ReverendFitty
    Level 1 (0 points)
    Feb 20, 2013 7:35 PM in response to ReverendFitty

    The iNode file is what is left over after the fscheck (disk repair) does its job.  It is usually an orphaned block of data (inode) that was not properly dereferenced when a file was deleted.  Inodes in general are low level data structures, however, a file named iNode is no more low-level than any other file.  The disk repair utility finds these orphaned data chunks, dereferences them, but saves a copy in the lost+found just in case they contain important data and the used had tried to brute-force cancel an unintended delete.  If not needed, these files can be safely deleted. 

     

    In this case, Finder or the AppStore app had most likely crashed or had to be force quit while in the process of deleting the file after the successful OS upgrade.

     

    In my case my iNode file has 4172M, and is an archived volume named "Mac OS X Install ESD", containing

    the folders "Install OS X Mountain Lion.app", "Library", "Packages", "System" plus a whole bunch of hidden files.

  • by cello_,

    cello_ cello_ Mar 23, 2013 2:27 PM in response to smiff
    Level 1 (0 points)
    Mar 23, 2013 2:27 PM in response to smiff

    Well smiff, couldn't the x in xar refer to the x in OSX? I am quite sure an OS run by an Apple device would NOT use a MS-Office file type for documentation. Sounds odd...

  • by al p bundy,

    al p bundy al p bundy Mar 23, 2013 4:08 PM in response to cello_
    Level 1 (0 points)
    Mar 23, 2013 4:08 PM in response to cello_

    You are right that the mystery file has nothing to do with MS Excel. 

     

    Click on the search icon on the OS X menu bar (the magnifying glas at the right), type "terminal" without the quotes.  Click on the application called Terminal. Once the Terminal window opens, type the following: "man xar", without the quotes, then press enter. You will be presented with the system manual for the archiver called xar.  Use the up/down arrows to scroll, or press "q" to exit. 

     

    Reading through that documentation it should become obvious that xar is a file archive/compression format similar to the popular ZIP.  The unknown file is the downloaded OS X upgrade packed in the xar format.

     

     

    "DESCRIPTION

           The  XAR  project  aims to provide an easily extensible archive format.

           Important design decisions include an easily extensible  XML  table  of

           contents  (TOC) for random access to archived files, storing the TOC at

           the beginning of  the  archive  to  allow  for  efficient  handling  of

           streamed  archives,  the  ability  to handle files of arbitrarily large

           sizes, the ability to choose independent encodings for individual files

           in  the archive, the ability to store checksums for individual files in

           both compressed and uncompressed form, and the ability to query the ta-

           ble of content's rich meta-data."

  • by Lucas_D,

    Lucas_D Lucas_D Nov 10, 2013 5:36 AM in response to ReverendFitty
    Level 1 (0 points)
    Nov 10, 2013 5:36 AM in response to ReverendFitty

    I had 2 of these large files. I did control-click --> Open with --> DiskImageMounter.app, and discovered that they appeared to be the Lion and Mountain Lion install files (I now run Mavericks). I deleted both, freeing up nearly 8 gb, and all seems well so far.

  • by ---———---,

    ---———--- ---———--- Nov 25, 2013 12:43 AM in response to Lucas_D
    Level 1 (10 points)
    Nov 25, 2013 12:43 AM in response to Lucas_D

    My iNode6689314 file is 5,29GB and created 23 of Oct this year. That aught to be when I installed Mavericks.

     

    On macrumors Bernuli posts that

    What you see in lost+found is the result of a filesystem check, or Disk First Aid running and finding a some things out of alignment. Not a big deal, unless you have a bazillion of those files. Then you should find out what is causing it.

    Full thread

     

    That seems likely in my case.

  • by redpola,

    redpola redpola Dec 2, 2014 4:21 AM in response to ReverendFitty
    Level 1 (29 points)
    Wireless
    Dec 2, 2014 4:21 AM in response to ReverendFitty

    I found this thread after discovering 5GB of file in /lost+found/

     

    lost+found is simply a place that the filesystem checking utility dumps data it finds "unusually", just in case that data can be recovered. Practically, it happens when machines crash or are powered off unexpectedly.

     

    If you run "file /lost+found/iNode*" you may find it is an xar archive, which can be inspected using "xar -t -f <filename>" and on my system this was rather obviously the Mac OS X installer.

     

    The file contains data which were orphaned on your filesystem. It most likely happened during a delete as the system crashed or powered off. It's very unlikely you will need or miss those data.

     

    Delete the file. If it appears again when you next boot, boot to the installer and repair the disk.

  • by MarjB,

    MarjB MarjB Dec 13, 2014 11:32 AM in response to ReverendFitty
    Level 1 (0 points)
    Dec 13, 2014 11:32 AM in response to ReverendFitty

    I just updated daughter's macbook pro.  using the daisy disk....I found 3 of these inodes lost+found that equals to 14.8 GB.  that's alot of space.

     

    in simple man terms what do I do?  thanks

  • by flexcapacitor,

    flexcapacitor flexcapacitor Apr 1, 2015 5:19 AM in response to ReverendFitty
    Level 1 (0 points)
    Apr 1, 2015 5:19 AM in response to ReverendFitty

    I had two of these files. I was using Disk Inventory X to find out why I ran out of disk space. I opened Disk Utility and dragged one of the files in. I then clicked open image and after a minute or so it showed that it was OSX Installer.

     

    Screen Shot 2015-04-01 at 5.00.56 AM.png

     

    Both were named "OS X Install ESD" (I took a screenshot before the second one finished mounting).

     

    I moved both of them to the trash and it prompted me to authenticate. Afterwards I restarted and everything booted up fine. I then emptied the trash and restarted again. Everything is still working fine and I have 10 GB of disk space back. Thanks!

  • by amyseqmedia,Helpful

    amyseqmedia amyseqmedia Apr 15, 2015 9:32 AM in response to Pascal Balthrop
    Level 1 (5 points)
    Apr 15, 2015 9:32 AM in response to Pascal Balthrop

    .xar is an archive format: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/ man1/xar.1.html

     

    I first ran "file" to check it:

     

    > file iNode38857788

    iNode38857788: xar archive - version 1

     

    Then I ran "xar -t" on the file and got:

     

    /lost+found > xar -t -f iNode38857788

    Distribution

    InstallMacOSX.pkg

    InstallMacOSX.pkg/Bom

    InstallMacOSX.pkg/Payload

    InstallMacOSX.pkg/Scripts

    InstallMacOSX.pkg/PackageInfo

    InstallMacOSX.pkg/InstallESD.dmg

    Resources

    Resources/ar.lproj

    Resources/ar.lproj/Localizable.strings

    Resources/ar.lproj/VolumeCheck.strings

    Resources/ca.lproj

    ... etc ...

  • by StephenM,

    StephenM StephenM Nov 4, 2015 9:05 AM in response to ReverendFitty
    Level 1 (123 points)
    Photography
    Nov 4, 2015 9:05 AM in response to ReverendFitty

    I found this on the

    lost + found folder

    . it is the most complete reference I have found. It talks about the enclosed inode file, how it likely got there, how to check it and gives some indications on whether can be safely deleted or not.

  • by ziggy6894,

    ziggy6894 ziggy6894 Jan 21, 2016 1:01 PM in response to ReverendFitty
    Level 1 (8 points)
    Photos for Mac
    Jan 21, 2016 1:01 PM in response to ReverendFitty
  • by mallarcky,

    mallarcky mallarcky Mar 4, 2016 4:07 PM in response to ReverendFitty
    Level 1 (4 points)
    Mar 4, 2016 4:07 PM in response to ReverendFitty

    I also did

     

        cd /lost+found

        xar -f iNode17698873 -t

     

    and found that the contents of the archive was

     

    Distribution

    InstallMacOSX.pkg

    InstallMacOSX.pkg/Bom

    InstallMacOSX.pkg/Payload

    InstallMacOSX.pkg/Scripts

    InstallMacOSX.pkg/PackageInfo

    InstallMacOSX.pkg/InstallESD.dmg

    Resources

    Resources/ar.lproj

    Resources/ar.lproj/Localizable.strings

              ..... more resoures/.... stuff

     

    So I did

     

    sudo mv iNode17698873 ~/Desktop/.

     

    And restarted my computer.

     

    My computer works fine and I saved ~4 GB. So then I safely deleted iNode17698873 and restarted just fine

Previous Page 2 of 3 last Next