SEO
vBulletin Search Engine Optimization
| |||||||
![[OT] Recovering a deleted file that is still open](http://unixadmintalk.com/iconimages/f11/ot-recovering-deleted-file-still-open_ltr.gif)
| Register | FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
05-10-2008, 01:58 PM
| ||||
| ||||
 [OT] Recovering a deleted file that is still open If I have accidentally deleted a file that is still being used by some application (read or write mode), is it possible to recover such a file? Especially since the file is not really deleted until the descriptor is closed by the application? Just wondering... Raj Kiran Grandhi -- Politics is for the moment. An equation is for eternity. -- Albert Einstein -- To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org      |
|
05-10-2008, 01:58 PM
| |||
| |||
| Re: [OT] Recovering a deleted file that is still open Raj Kiran Grandhi wrote: > If I have accidentally deleted a file that is still being used by some > application (read or write mode), is it possible to recover such a file? > Especially since the file is not really deleted until the descriptor is > closed by the application? > > Just wondering... Yes, get the pid of the process that has the file open, then go to /proc/PID/fd/ joey@kodama:/proc/19553/fd>dir total 0 dr-x------ 2 joey joey 0 May 8 00:36 ./ dr-xr-xr-x 6 joey joey 0 May 8 00:36 ../ lrwx------ 1 joey joey 64 May 8 00:36 0 -> /dev/pts/10 lrwx------ 1 joey joey 64 May 8 00:36 1 -> /dev/pts/10 lrwx------ 1 joey joey 64 May 8 00:36 2 -> /dev/pts/10 lr-x------ 1 joey joey 64 May 8 00:36 6 -> /home/joey/foo~\ (deleted) joey@kodama:/proc/19553/fd>cat 6 >~/foo -- see shy jo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFIIoOqd8HHehbQuO8RAm6yAJ0fq9kTZZM6KEfXMV6Jln yPFbNINQCg66x8 YjYt8sIj80H9kJw+gib+SUI= =zpoL -----END PGP SIGNATURE----- |
|
05-10-2008, 01:58 PM
| |||
| |||
| Re: [OT] Recovering a deleted file that is still open > * From: Raj Kiran Grandhi <grajkiran@gmail.com> > If I have accidentally deleted a file that is still being used by some > application (read or write mode), is it possible to recover such a file? Especially since > the file is not really deleted until the descriptor is closed by the application? yes, for example using lsof and coping with cp a file from proc. A google search explains this. If with lsof|grep deletd you find that the file descriptor 4 of process with pid 14243 corresponds to /path/to/the/deleted/file then cp -pu /proc/14243/fd/4 /path/to/the/deleted/file.SAVED (I am from memory, do a google search to find the exact commands) -- To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org |
|
05-10-2008, 01:58 PM
| |||
| |||
| Re: [OT] Recovering a deleted file that is still open -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/07/08 23:38, Joey Hess wrote: > Raj Kiran Grandhi wrote: >> If I have accidentally deleted a file that is still being used by some >> application (read or write mode), is it possible to recover such a file? >> Especially since the file is not really deleted until the descriptor is >> closed by the application? >> >> Just wondering... > > Yes, get the pid of the process that has the file open, then go to > /proc/PID/fd/ > > joey@kodama:/proc/19553/fd>dir > total 0 > dr-x------ 2 joey joey 0 May 8 00:36 ./ > dr-xr-xr-x 6 joey joey 0 May 8 00:36 ../ > lrwx------ 1 joey joey 64 May 8 00:36 0 -> /dev/pts/10 > lrwx------ 1 joey joey 64 May 8 00:36 1 -> /dev/pts/10 > lrwx------ 1 joey joey 64 May 8 00:36 2 -> /dev/pts/10 > lr-x------ 1 joey joey 64 May 8 00:36 6 -> /home/joey/foo~\ (deleted) > joey@kodama:/proc/19553/fd>cat 6 >~/foo That's a spiffy idea! - -- Ron Johnson, Jr. Jefferson LA USA We want... a Shrubbery!! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFIIoYdS9HxQb37XmcRAsIOAJ9HL/A0Q87xcILLC6DQHQ5rXtuDggCdHciS 2F4BD0ts/SRA7yQFsLKpa2I= =hO04 -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org |
|
05-10-2008, 01:59 PM
| |||
| |||
| Re: [OT] Recovering a deleted file that is still open Joey Hess wrote: > Raj Kiran Grandhi wrote: >> If I have accidentally deleted a file that is still being used by some >> application (read or write mode), is it possible to recover such a file? >> Especially since the file is not really deleted until the descriptor is >> closed by the application? >> >> Just wondering... > > Yes, get the pid of the process that has the file open, then go to > /proc/PID/fd/ > > joey@kodama:/proc/19553/fd>dir > total 0 > dr-x------ 2 joey joey 0 May 8 00:36 ./ > dr-xr-xr-x 6 joey joey 0 May 8 00:36 ../ > lrwx------ 1 joey joey 64 May 8 00:36 0 -> /dev/pts/10 > lrwx------ 1 joey joey 64 May 8 00:36 1 -> /dev/pts/10 > lrwx------ 1 joey joey 64 May 8 00:36 2 -> /dev/pts/10 > lr-x------ 1 joey joey 64 May 8 00:36 6 -> /home/joey/foo~\ (deleted) > joey@kodama:/proc/19553/fd>cat 6 >~/foo > Cool! Thanks for that. I had noticed those links but did not think of cat'ing a broken symbolic link. -- Raj Kiran Grandhi -- Politics is for the moment. An equation is for eternity. -- Albert Einstein -- To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org |
|
05-10-2008, 01:59 PM
| ||||
| ||||
| Re: [OT] Recovering a deleted file that is still open Joey Hess wrote: > Raj Kiran Grandhi wrote: >> If I have accidentally deleted a file that is still being used by some >> application (read or write mode), is it possible to recover such a file? >> Especially since the file is not really deleted until the descriptor is >> closed by the application? >> >> Just wondering... > > Yes, get the pid of the process that has the file open, then go to > /proc/PID/fd/ > > joey@kodama:/proc/19553/fd>dir > total 0 > dr-x------ 2 joey joey 0 May 8 00:36 ./ > dr-xr-xr-x 6 joey joey 0 May 8 00:36 ../ > lrwx------ 1 joey joey 64 May 8 00:36 0 -> /dev/pts/10 > lrwx------ 1 joey joey 64 May 8 00:36 1 -> /dev/pts/10 > lrwx------ 1 joey joey 64 May 8 00:36 2 -> /dev/pts/10 > lr-x------ 1 joey joey 64 May 8 00:36 6 -> /home/joey/foo~\ (deleted) > joey@kodama:/proc/19553/fd>cat 6 >~/foo > Neat Joey! Hugo -- To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org |
Linear Mode
