How do I check if it is safe to delete the following file?

$ cd /lost+found/
$ file iNode44670523
iNode46670523: xar archive -version 1

Note: the date of the file indicates it is about 1 year old. the first 4 characters of the file are "xar!"

can I just delete it (it's probably backed up by Time Machine) and reboot and check that everything runs fine as it is? is there any simple way to inspect the contents of the file?


If you're comfortable using the terminal, you might be able to figure out what the file is. If you're not comfortable using terminal, I wouldn't worry about doing this. I was doing this mainly for my own interest rather than any real need.

Open terminal and enter the following commands (enter the text following the $):

$ cd /lost+found
$ ls -l
total 10087432
-rw-r--r--  1 root  wheel  5164763151 25 Oct  2014 iNode10324487

$ file iNode10324487
iNode10324487: xar archive - version 1

This tells me the iNode10324487 file is meant to be of type xar, which is an archive file. A quick search for "binary file xar" finds the man page for the xar utility on OS X. This tells me that I can view the list of files contained within the xar file with the following command:

$ xar -t -f iNode10324487

So the orphaned file that I've got taking up 5.16GB on my disk looks like an OS X installer package. I'm pretty confident that I don't need that, so I can delete it.

  • 7
    I also had a Mac OS X installer as an iNode file inside lost+found. Thanks for the info. – gdelfino Aug 22 '15 at 18:52
  • Excellent terminal tips. Ended up with the exact same thing and was confident I could toss it. Thank you. – squareman Dec 9 '15 at 20:08
  • Also had a lost xar with InstallMacOSX.pkg – Nic Cottrell Jan 6 '17 at 11:30

File in lost+found are fragments of files that have been found by a disk repair job (usually ran through disk utility). A more clear explanation in this thread. Extract:

If you run fsck, the filesystem check and repair command, it might find data fragments that are not referenced anywhere in the filesystem. In particular, fsck might find data that looks like a complete file but doesn't have a name on the system — an inode with no corresponding file name. This data is still using up space, but it isn't accessible by any normal means.

The file is probably unusable. The system doesn't rely on it, and if you don't have any use for it (which I'm assuming since you don't know what's in it) you are safe to delete it.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.