Re: Quasi-(un)deletion question

[Martin Dickopp <martin-deb@zero-based.org>]

Tim Otten <tim@cap.american.edu> writes:

> The other day, I did something really stupid. I started a download with
> BitTorrent, and, half-way through, deleted the file it was downloading.
>
> The file still existed because the torrent client had it open. I could use
> 'lsof' to get an inode number -- but I needed some way to get access to
> that node without having an entry in the file tree.
>
> I looked in a bunch of obvious places -- /proc/nnn/fd, man pages and
> source for mknod, ln, and libc's link(). But it seems that all the work
> relating to actual inodes is done in kernel space -- where I have no
> experience.

/proc/PID/fd seems to work just fine; see transcript below.

> Is it possible to access the file using a utility or small C program?  
> Would you have to write code for the kernel?


martin@feynman:~ > echo This is a test. > t.txt
martin@feynman:~ > tail -f t.txt > /dev/null &       # keep file open
[1] 1334
martin@feynman:~ > rm t.txt
martin@feynman:~ > cat t.txt
cat: t.txt: No such file or directory
martin@feynman:~ > cd /proc/1334/fd
martin@feynman:/proc/1334/fd > ls -l
total 0
lrwx------  1 martin  users   64 Feb 15 19:45 0 -> /dev/pts/2
l-wx------  1 martin  users   64 Feb 15 19:45 1 -> /dev/null
lrwx------  1 martin  users   64 Feb 15 19:45 2 -> /dev/pts/2
lr-x------  1 martin  users   64 Feb 15 19:45 3 -> /home/martin/t.txt (deleted)
martin@feynman:/proc/1334/fd > cat 3
This is a test.
martin@feynman:/proc/1334/fd > cat 3 > ~/recovered
martin@feynman:/proc/1334/fd > cd       
martin@feynman:~ > kill 1334
[1]+  Terminated              tail -f t.txt >/dev/null
martin@feynman:~ > cat recovered 
This is a test.


Martin