[Discuss] recover contents of deleted but still open file on a Linux system.

[Bill Bogstad]

I just learned a technique to recover the contents of an open but
deleted file which I wanted to share here.  The trick is to use the
/proc/PID/fd/# file.   The file has to still be open by
some process on the system.   While you can't link the entry in the
/proc directory back
to a real filesystem, you can view/copy the contents.   I could see
this coming in handy
for one of those oops moments.  I've only tested this on one Linux
system, but I suspect it will work on any Linux system. Example below.

Bill Bogstad

Script started on 2020-07-06 13:21:36-04:00
$ pwd
/home/bogstad
$ ( echo foobar ; sleep 3000 ) > foo &
$ ps
    PID TTY          TIME CMD
  27942 pts/2    00:00:00 bash
  27951 pts/2    00:00:00 sh
  27958 pts/2    00:00:00 sleep
  27966 pts/2    00:00:00 ps
$ cd /proc/27958/fd
$ ls -l
total 0
lrwx------ 1 bogstad bogstad 64 Jul  6 13:22 0 -> /dev/pts/2
l-wx------ 1 bogstad bogstad 64 Jul  6 13:22 1 -> /home/bogstad/foo
lrwx------ 1 bogstad bogstad 64 Jul  6 13:22 15 -> /dev/dri/card0
lrwx------ 1 bogstad bogstad 64 Jul  6 13:22 2 -> /dev/pts/2
lrwx------ 1 bogstad bogstad 64 Jul  6 13:22 24 -> /dev/dri/renderD128
lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 61 ->
'/home/bogstad/.local/share/gvfs-metadata/root (deleted)'
lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 67 ->
'/home/bogstad/.local/share/gvfs-metadata/root-82b65bb8.log (deleted)'
lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 95 ->
'/home/bogstad/.local/share/gvfs-metadata/home (deleted)'
lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 96 ->
'/home/bogstad/.local/share/gvfs-metadata/home-6f00ef34.log (deleted)'
lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 98 ->
/home/bogstad/.local/share/gvfs-metadata/trash:
lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 99 ->
/home/bogstad/.local/share/gvfs-metadata/trash:-08bce324.log
$ cat 1
foobar
$ cat /home/bogstad/foo
foobar
$ echo stuff >> /home/bogstad/foo
$ cat 1
foobar
stuff
$ rm /home/bogstad/foo
$ ls -l /home/bogstad/foo
ls: cannot access '/home/bogstad/foo': No such file or directory
$ cat 1
foobar
stuff
$ exit
Script done on 2020-07-06 13:23:12-04:00 [COMMAND_EXIT_CODE="0"]