[Discuss] recover contents of deleted but still open file on a Linux system.

[Derek Martin]

On Tue, Jul 07, 2020 at 11:10:33AM -0400, Rich Pieri wrote:
> Something along these lines should work on probably any UNIX or
> UNIX-like system. Unlinking a file removes the directory entry but the
> storage blocks are not released for reuse until all file handles are
> closed. This ends up being more of an annoyance than a benefit when
> long-running jobs put big files on scratch storage which is
> periodically pruned.

Or when some well-meaning junior admin deletes large log files to free
up space, while the process writing to them still has them open...

FWIW for much the same reason, you can also use lsof to find
open-but-deleted files... its output will identify them as deleted.
This will tell you what process has the file open so you can kill it
(which closes the file, enabling its used disk blocks to be reclaimed,
assuming there are not other processes that also have it open).

-- 
Derek D. Martin    http://www.pizzashack.org/   GPG Key ID: 0xDFBEAD02
-=-=-=-=-
This message is posted from an invalid address.  Replying to it will result in
undeliverable mail due to spam prevention.  Sorry for the inconvenience.