how to check if it is safe to delete iNode file (or how to inspect its contents)?

Question

How do I check if it is safe to delete the following file?

$ cd /lost+found/
$ file iNode44670523
iNode46670523: xar archive -version 1

Note: the date of the file indicates it is about 1 year old. the first 4 characters of the file are "xar!"

can I just delete it (it's probably backed up by Time Machine) and reboot and check that everything runs fine as it is? is there any simple way to inspect the contents of the file?

Answer 1

If you're comfortable using the terminal, you might be able to figure out what the file is. If you're not comfortable using terminal, I wouldn't worry about doing this. I was doing this mainly for my own interest rather than any real need.

Open terminal and enter the following commands (enter the text following the $):

$ cd /lost+found
$ ls -l
total 10087432
-rw-r--r--  1 root  wheel  5164763151 25 Oct  2014 iNode10324487

$ file iNode10324487
iNode10324487: xar archive - version 1

This tells me the iNode10324487 file is meant to be of type xar, which is an archive file. A quick search for "binary file xar" finds the man page for the xar utility on OS X. This tells me that I can view the list of files contained within the xar file with the following command:

$ xar -t -f iNode10324487
Distribution
InstallMacOSX.pkg
InstallMacOSX.pkg/Bom
InstallMacOSX.pkg/Payload
InstallMacOSX.pkg/Scripts
InstallMacOSX.pkg/PackageInfo
InstallMacOSX.pkg/InstallESD.dmg
Resources
Resources/ar.lproj
...

So the orphaned file that I've got taking up 5.16GB on my disk looks like an OS X installer package. I'm pretty confident that I don't need that, so I can delete it.

Answer 2

File in lost+found are fragments of files that have been found by a disk repair job (usually ran through disk utility). A more clear explanation in this thread. Extract:

If you run fsck, the filesystem check and repair command, it might find data fragments that are not referenced anywhere in the filesystem. In particular, fsck might find data that looks like a complete file but doesn't have a name on the system — an inode with no corresponding file name. This data is still using up space, but it isn't accessible by any normal means.

The file is probably unusable. The system doesn't rely on it, and if you don't have any use for it (which I'm assuming since you don't know what's in it) you are safe to delete it.