How to undelete any open, deleted file on linux.

Fri, 02/20/2009 - 13:01 — chrisdew

Introduction

There are many situations where a file has been deleted (typically by an overnight log-cleaning process), yet the inode is still held open by a process reading from, or writing to, it. Recovery of such a file is simple, regardless of whether it is on ext2, ext3, reiserfs or any other filesystem.

When a file is deleted in linux, it is simply 'unlinked'. The inode, which contains the file's data, is not deleted until all processes have finished with it. This is why processes can carry on writing to deleted files.

(Incidentally, this is why linux can be upgraded without requiring a reboot. Programmes, which have shared libraries open, carry on using the old versions of shared libraries until they finish.)

Demonstration

Let's make a test file, and hold it open with a backgrounded 'tail -f':

chris@chris-laptop:/tmp$ echo "hello world" > testfile
chris@chris-laptop:/tmp$ tail -f testfile &
[1] 8530
chris@chris-laptop:/tmp$ hello world

8530 is the process id of the tail command. Let's look at the file descriptors used by the tail:

chris@chris-laptop:/tmp$ ls -lA /proc/8530/fd
total 0
lrwx------ 1 chris chris 64 2009-02-20 10:32 0 -> /dev/pts/23
lrwx------ 1 chris chris 64 2009-02-20 10:32 1 -> /dev/pts/23
lrwx------ 1 chris chris 64 2009-02-20 10:32 2 -> /dev/pts/23
lr-x------ 1 chris chris 64 2009-02-20 10:32 3 -> /home/tmp/testfile
lr-x------ 1 chris chris 64 2009-02-20 10:32 62 -> pipe:[18848062]
lr-x------ 1 chris chris 64 2009-02-20 10:32 63 -> pipe:[18848057]

Now we can delete the test file, check that it's deleted and have another look at this tail's file descriptors.

chris@chris-laptop:/tmp$ rm testfile
chris@chris-laptop:/tmp$ ls testfile
ls: cannot access testfile: No such file or directory
chris@chris-laptop:/tmp$ ls -lA /proc/8530/fd
total 0
lrwx------ 1 chris chris 64 2009-02-20 10:32 0 -> /dev/pts/23
lrwx------ 1 chris chris 64 2009-02-20 10:32 1 -> /dev/pts/23
lrwx------ 1 chris chris 64 2009-02-20 10:32 2 -> /dev/pts/23
lr-x------ 1 chris chris 64 2009-02-20 10:32 3 -> /home/tmp/testfile (deleted)
lr-x------ 1 chris chris 64 2009-02-20 10:32 62 -> pipe:[18848062]
lr-x------ 1 chris chris 64 2009-02-20 10:32 63 -> pipe:[18848057]

The file descriptor shows that the file has been deleted. Now all we have to do is to recover the file. Luckily, we can access the file's contents via the process's file descriptor link.

chris@chris-laptop:/tmp$ cat /proc/8530/fd/3
hello world
chris@chris-laptop:/tmp$ ls testfile
ls: cannot access testfile: No such file or directory
chris@chris-laptop:/tmp$ cp /proc/8530/fd/3 testfile
chris@chris-laptop:/tmp$ ls -lA testfile
-rw-r--r-- 1 chris chris 12 2009-02-20 10:34 testfile
chris@chris-laptop:/tmp$ cat testfile 
hello world

Job done. Thanks to my colleagues, at ApplianSys, for requiring this solution.

chrisdew's blog
Login or register to post comments
45379 reads

Comments

Sun, 05/30/2010 - 18:05 — lemerian

Real Estate | Homes | 3.5%

Fri, 05/28/2010 - 00:52 — echealth

health insurance

health insurance quote
Florida Public Insurance Adjuster
Florida Auto Insurance Quote
Florida Plumbers
Florida Annuity Quotes
Cigna Health Insurance
AARP Health Insurance Quotes
United Health Care
Vista Health Insurance Quote
Florida health insurance
Florida Auto Insurance Quote
Insurance Agent CRM
Avmed Florida Health Insurance
Aetna health insurance quote
Florida Annuity Quotes

Fri, 05/14/2010 - 21:37 — lemerian

Real Estate | Homes | 3.5%

Thu, 04/29/2010 - 08:54 — lemerian

Real Estate | Homes | 3.5%

Tue, 04/06/2010 - 14:02 — lemerian

affordable homes in

Sun, 04/18/2010 - 14:59 — randi420

Travel insurance can save

Travel insurance can save your wallet from serious trouble when the unexpected happens on your trip. Many people think of travel insurance as a necessity for international travel, but will skip it for domestic trips.

( Download TV Shows | Download Movies )

Tue, 03/30/2010 - 08:14 — qqq

watches

Shen Xu-Hui: "North Korea's accountability system," doubtsreplica watchesMozambique Matola cement factory will increase production capacityreplica watchesMayor of New York hippie dress stunning fund-raising dinnerreplica watchesCloser look crocodile "badly" the joy of enjoying delicious (Chart)replica watchesCongo (DRC) Government denies that human rights organizations on the massacre of 321 civilians were(L3.30)

Fri, 03/26/2010 - 07:21 — swatbolish

Thanks for your guide, i have

Thanks for your guide, i have more linux acknowledge need to learn.

registry winner review

Fri, 03/26/2010 - 03:04 — liumang

ag

Balenciaga Lambskin Leather Giant City Bag 084332d Eepbrown2 192.00
Balenciaga Genuine Leather Giant Money Wallet 09001 94.40
Balenciaga Lambskin Leather Giant City Bag 084332d Eepgray 192.00

Balenciaga Lambskin Leather Giant City Bag 084332d Eepbrown2 192.00
Balenciaga Lambskin Leather Giant City Bag 084332d Eepgray1 192.00

Balenciaga Lambskin Leather Giant City Bag 084332d Eepbrown2 192.00
Louis Vuitton Genuine Leather Latest Fashion Shoulder Bag 6258 C 151.20

Louis Vuitton Monogram Canvas Cowskin Leather Bag M81012 Black 158.40
Louis Vuitton Monogram Canvas Cowskin Leather Bag M81012 158.40
Louis Vuitton Genuine Leather Latest Fashion Shoulder Bag 6258 O 151.20

Balenciaga Lambskin Leather First Motorcycle Bag 084331a Deeppin 135.20

Balenciaga Lambskin Leather First Motorcycle Bag 084331a Deepyel 135.20
Balenciaga Lambskin Leather First Motorcycle Bag 084331a Deeppur 135.20
Balenciaga Lambskin Leather First Motorcycle Bag 084331a Deepsky 135.20

Balenciaga Lambskin Leather First Motorcycle Bag 084331a Deepyel 135.20
Balenciaga Lambskin Leather First Motorcycle Bag 084331a Brown 135.20

Wed, 03/24/2010 - 17:34 — Marcossp

I am conducting a survey and

I am conducting a survey and would like to know if you could tell me more links about the topic discussed. I am very grateful!
Thank you.

otimização de sites desentupidora grafica clinica de estetica acompanhantes transportadora relogio de ponto dentista

Mon, 03/22/2010 - 10:30 — jamessmithforum

Free Web Directory | 1 | 1 |1

Free Web Directory | 1 | 1 |1 | 1 |1 |1 |1 |1 |1 |1 |1 |1 | 1 |1 |1 |1 | |SEO Blogs | Human Resources | SEO Architect | 1 | 1 | 1 | 1 | Indian SEO Company | 1 | 1 | 1 | Local Classified | Free Blogs | Watch Movie online | Oriya Matrimonials | Maharashtra Tourism | Goa Tourism | Insurance Info | Travel Info | Sport Info | Health Info | Free Directory | Free Directory | Web Directory | Wed Designing | Fashion Tips

Mon, 03/22/2010 - 14:53 — haw

We can get bulk of

We can get bulk of knowledge.
regards,
SEO

Wed, 03/17/2010 - 07:41 — bbnet

Great article, this is useful

Great article, this is useful post. keep up posting.
Ngan hang|Vay mua nha|Ngân hàng

Fri, 03/12/2010 - 19:00 — several

Kudos for this article. Very

Kudos for this article. Very intriguing and professionally published blog post. I will visit again in future.
brother mfc-840w

Tue, 03/09/2010 - 01:38 — katharinbonner

Linux Problems

I'm having problems using Linux. I have written research papers about certain technical problems about Linux but, I can't seem to find the bug that has been bugging for the past few months. Add more info, please!

Thu, 03/04/2010 - 09:50 — lemerian

Let's make a test file, and

Let's make a test file, and hold it open with a backgrounded 'tail -f':

chris@chris-laptop:/tmp$ echo "hello world" > testfile
chris@chris-laptop:/tmp$ tail -f testfile &
[1] 8530
chris@chris-laptop:/tmp$ hello world

8530 is the process id of the tail command. Let's look at the file descriptors used by the tail:

chris@chris-laptop:/tmp$ ls -lA /proc/8530/fd
total 0
lrwx------ 1 chris chris 64 2009-02-20 10:32 0 -> /dev/pts/23
lrwx------ 1 chris chris 64 2009-02-20 10:32 1 -> /dev/pts/23
lrwx------ 1 chris chris 64 2009-02-20 10:32 2 -> /dev/pts/23
lr-x------ 1 chris chris 64 2009-02-20 10:32 3 -> /home/tmp/testfile
lr-x------ 1 chris chris 64 2009-02-20 10:32 62 -> pipe:[18848062]
lr-x------ 1 chris chris 64 2009-02-20 10:32 63 -> pipe:[18848057]

Sun, 02/21/2010 - 01:58 — edhardy11

Abercrombie

High Waist Straight-leg pants outfit stunted jacket, showing slender eye-catching position, pertinent mixture of units Cheap Abercrombie and Fitch Outerwears Cheap Abercrombie and Fitch Outerwears discount Abercrombie and Fitch Outerwears discount Abercrombie and Fitch Outerwears Abercrombie and Fitch Outerwears sale Abercrombie and Fitch Outerwears sale buy Abercrombie and Fitch Outerwears buy Abercrombie and Fitch Outerwears Cheap Abercrombie Fitch Outerwears Cheap Abercrombie Fitch Outerwears discount Abercrombie Fitch Outerwears discount Abercrombie Fitch Outerwears Abercrombie Fitch Outerwears sale Abercrombie Fitch Outerwears sale buy Abercrombie Fitch Outerwears buy Abercrombie Fitch Outerwears Cheap Abercrombie Outerwears Cheap Abercrombie Outerwears discount Abercrombie Outerwears discount Abercrombie Outerwears Abercrombie Outerwears sale Abercrombie Outerwears sale buy Abercrombie Outerwears at Break; DSquared jeans on The patches, holes, stains a Less.

final cog

Navigation

User login