[Discuss] recover contents of deleted but still open file on a Linux system.

[Jerry Feldman]

Additionally, you can use debugfs along with the inode to create a link

On Mon, Jul 6, 2020 at 1:37 PM Bill Bogstad <bogstad at pobox.com> wrote:

> I just learned a technique to recover the contents of an open but
> deleted file which I wanted to share here.  The trick is to use the
> /proc/PID/fd/# file.   The file has to still be open by
> some process on the system.   While you can't link the entry in the
> /proc directory back
> to a real filesystem, you can view/copy the contents.   I could see
> this coming in handy
> for one of those oops moments.  I've only tested this on one Linux
> system, but I suspect it will work on any Linux system. Example below.
>
> Bill Bogstad
>
> Script started on 2020-07-06 13:21:36-04:00
> $ pwd
> /home/bogstad
> $ ( echo foobar ; sleep 3000 ) > foo &
> $ ps
>     PID TTY          TIME CMD
>   27942 pts/2    00:00:00 bash
>   27951 pts/2    00:00:00 sh
>   27958 pts/2    00:00:00 sleep
>   27966 pts/2    00:00:00 ps
> $ cd /proc/27958/fd
> $ ls -l
> total 0
> lrwx------ 1 bogstad bogstad 64 Jul  6 13:22 0 -> /dev/pts/2
> l-wx------ 1 bogstad bogstad 64 Jul  6 13:22 1 -> /home/bogstad/foo
> lrwx------ 1 bogstad bogstad 64 Jul  6 13:22 15 -> /dev/dri/card0
> lrwx------ 1 bogstad bogstad 64 Jul  6 13:22 2 -> /dev/pts/2
> lrwx------ 1 bogstad bogstad 64 Jul  6 13:22 24 -> /dev/dri/renderD128
> lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 61 ->
> '/home/bogstad/.local/share/gvfs-metadata/root (deleted)'
> lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 67 ->
> '/home/bogstad/.local/share/gvfs-metadata/root-82b65bb8.log (deleted)'
> lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 95 ->
> '/home/bogstad/.local/share/gvfs-metadata/home (deleted)'
> lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 96 ->
> '/home/bogstad/.local/share/gvfs-metadata/home-6f00ef34.log (deleted)'
> lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 98 ->
> /home/bogstad/.local/share/gvfs-metadata/trash:
> lr-x------ 1 bogstad bogstad 64 Jul  6 13:22 99 ->
> /home/bogstad/.local/share/gvfs-metadata/trash:-08bce324.log
> $ cat 1
> foobar
> $ cat /home/bogstad/foo
> foobar
> $ echo stuff >> /home/bogstad/foo
> $ cat 1
> foobar
> stuff
> $ rm /home/bogstad/foo
> $ ls -l /home/bogstad/foo
> ls: cannot access '/home/bogstad/foo': No such file or directory
> $ cat 1
> foobar
> stuff
> $ exit
> Script done on 2020-07-06 13:23:12-04:00 [COMMAND_EXIT_CODE="0"]
> _______________________________________________
> Discuss mailing list
> Discuss at lists.blu.org
> http://lists.blu.org/mailman/listinfo/discuss
>


-- 
--
Jerry Feldman <gaf.linux at gmail.com>
Boston Linux and Unix
PGP key id: 6F6BB6E7
Key fingerprint: 0EDC 2FF5 53A6 8EED 84D1  3050 5715 B88D 6F6B B6E7