Re: [OT] Recovering a deleted file that is still open

[Raj Kiran Grandhi <grajkiran@gmail.com>]

Joey Hess wrote:
> Raj Kiran Grandhi wrote:
> > If I have accidentally deleted a file that is still being used by some
> > application (read or write mode), is it possible to recover such a file?  
> > Especially since the file is not really deleted until the descriptor is  
> > closed by the application?
> >
> > Just wondering...
>
> Yes, get the pid of the process that has the file open, then go to
> /proc/PID/fd/
>
> joey@kodama:/proc/19553/fd>dir
> total 0
> dr-x------ 2 joey joey  0 May  8 00:36 ./
> dr-xr-xr-x 6 joey joey  0 May  8 00:36 ../
> lrwx------ 1 joey joey 64 May  8 00:36 0 -> /dev/pts/10
> lrwx------ 1 joey joey 64 May  8 00:36 1 -> /dev/pts/10
> lrwx------ 1 joey joey 64 May  8 00:36 2 -> /dev/pts/10
> lr-x------ 1 joey joey 64 May  8 00:36 6 -> /home/joey/foo~\ (deleted)
> joey@kodama:/proc/19553/fd>cat 6 >~/foo

Cool! Thanks for that. I had noticed those links but did not think of 
cat'ing a broken symbolic link.

--
Raj Kiran Grandhi
--
Politics is for the moment. An equation is for eternity.
                                       -- Albert Einstein