[kwlug disc.] recovering deleted, but open, files

[Chris Frey]

Hi folks,

Last night, Glenn mentioned something about recovering deleted files
in his commentary on the lsof command.

I don't recall trying this before, but figured it might work.  In case
anyone else is interested, here's a reproduction of my experiment.

	cp somefile test
	less test

This opens the file test, and keeps it open.  In another window, as root,
I do the following:

	rm /home/cdfrey/test
	lsof | grep test

This shows me that less has the file test open, and that it is deleted.
It also shows me the process ID number.

	less      23629  cdfrey    4r   REG        3,3      2450    1376630 /home/cdfrey/test (deleted)

As root, I can continue to find this open file:

	cd /proc/23629/fd
	ls -l

lrwx------  1 cdfrey users 64 Dec  5 16:59 0 -> /dev/pty/s17
lrwx------  1 cdfrey users 64 Dec  5 16:59 1 -> /dev/pty/s17
lrwx------  1 cdfrey users 64 Dec  5 16:59 2 -> /dev/pty/s17
lr-x------  1 cdfrey users 64 Dec  5 16:59 3 -> /dev/tty
lr-x------  1 cdfrey users 64 Dec  5 16:59 4 -> /home/cdfrey/test (deleted)


This shows me which files that the less process has open, and even shows
that test is deleted, on my system.  To save a copy of this file somewhere
else, I do the following before less quits:

	cat 4 > /tmp/test

- Chris

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://listserv.ccjclearline.com/pipermail/kwlug-disc/attachments/20061205/75235ca6/attachment.bin