Here's a sensible question about the lost+found directories that various Unix filesystems stick in the top directory: why do they have to exist all the time? Yes, clearly fsck needs somewhere to put recovered files, but in theory it could just create a lost+found directory when needed, and otherwise you wouldn't have it cluttering up the filesystem.

Part of the answer is that lost+found isn't just a normal empty directory; instead, it's usually substantially bigger, despite having nothing in it.

The full answer is simple: because having a pre-existing lost+found directory means changing as little of the filesystem as possible during an fsck recovery. With an existing lost+found directory that has a bunch of empty directory entries, all fsck has to do to recover a file is fill in some data and rewrite a block.

Without an existing lost+found directory with empty entries, fsck would have to do a lot more; it would have to allocate an inode for the directory, allocate at least one data block for it, and add a directory entry to the filesystem's root directory (which might require allocating another data block and extending the directory). Of course, these changes would require checking and updating various potentially damaged filesystem data structures.

You could make an fsck that would do all this but it would clearly be more complicated, and complicated operations are undesirable in a filesystem recovery tool. Setting everything up ahead of time is much simpler.

(This entry was inspired by this comment.)