[Discuss] recover contents of deleted but still open file on a Linux system.

[chris at tylers.info (Chris Tyler)]

I once had a research assistant come to me almost trembling because he'd
deleted the disk images for a set of critical VMs. I asked if the VMs were
still running, and he said they were. So, I dd'd a copy of the disk images
using the technique you describe here, and all was well.

He bought me more free coffees than I could drink for the next month :-)

-Chris


On Tue, Jul 7, 2020 at 7:52 PM Bill Bogstad <bogstad at pobox.com> wrote:

> On Tue, Jul 7, 2020 at 10:54 AM Jerry Feldman <gaf.linux at gmail.com> wrote:
> >
> > Additionally, you can use debugfs along with the inode to create a link
>
> Never used that command, but from the manual page it looks straight
> forward to do so.
> Two thoughts though:
>
> 1. debugfs appears to only work with ext* filesystems.   The
> /proc/PID/fd method should work with XFS, ZFS, etc..
> 2.  debugfs appears to need read/write access to the disk partition.
> The method I suggested can be
> used by any unprivileged user who accidentally removes the output file
> of a long running program.
>
> Bill Bogstad
> _______________________________________________
> Discuss mailing list
> Discuss at lists.blu.org
> http://lists.blu.org/mailman/listinfo/discuss
>