[Discuss] recover contents of deleted but still open file on a Linux system.

[richard.pieri at gmail.com (Rich Pieri)]

On Thu, 9 Jul 2020 03:51:55 -0400
Bill Bogstad <bogstad at pobox.com> wrote:

> I'm not sure I'm following you here.   /proc not only lets me easily
> discover on what fd # the file is opened.  It also gives me an easy
> way to reopen the file so I can copy its contents.  How would you go
> about recovering the file easily without it?

You need to use some debugging tools on the running program to identify
the file descriptor and then write a program which opens that file
descriptor and copies the contents.

-- 
Rich Pieri