Re: [OT] Recovering a deleted file that is still open

[Ron Johnson <ron.l.johnson@cox.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/07/08 23:38, Joey Hess wrote:
> Raj Kiran Grandhi wrote:
>> If I have accidentally deleted a file that is still being used by some
>> application (read or write mode), is it possible to recover such a file?  
>> Especially since the file is not really deleted until the descriptor is  
>> closed by the application?
>>
>> Just wondering...
> 
> Yes, get the pid of the process that has the file open, then go to
> /proc/PID/fd/
> 
> joey@kodama:/proc/19553/fd>dir
> total 0
> dr-x------ 2 joey joey  0 May  8 00:36 ./
> dr-xr-xr-x 6 joey joey  0 May  8 00:36 ../
> lrwx------ 1 joey joey 64 May  8 00:36 0 -> /dev/pts/10
> lrwx------ 1 joey joey 64 May  8 00:36 1 -> /dev/pts/10
> lrwx------ 1 joey joey 64 May  8 00:36 2 -> /dev/pts/10
> lr-x------ 1 joey joey 64 May  8 00:36 6 -> /home/joey/foo~\ (deleted)
> joey@kodama:/proc/19553/fd>cat 6 >~/foo

That's a spiffy idea!

- --
Ron Johnson, Jr.
Jefferson LA  USA

We want... a Shrubbery!!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIIoYdS9HxQb37XmcRAsIOAJ9HL/A0Q87xcILLC6DQHQ5rXtuDggCdHciS
2F4BD0ts/SRA7yQFsLKpa2I=
=hO04
-----END PGP SIGNATURE-----