

How to undelete any open file on Linux - kirubakaran
http://finalcog.com/undelete-open-file-from-inode

======
jacquesm
If there would be a way to create a hardlink to that inode you could really
recover the file (lsof will show you the inode number).

Is there some arcane unix command that allows you to do that ?

If the file is large enough there may not be enough space to do a copy, so
that's why it would be nicer to actually restore that inode...

jam@jam:~$ touch z

jam@jam:~$ tail -f z

^Z

[1]+ Stopped

jam@jam:~$ rm z

jam@jam:~$ lsof | grep /home/jam/z

tail 19192 jam 3r REG 8,17 0 821339 /home/jam/z (deleted)

jam@jam:~$

The 821339 is the inode.

~~~
nuclear_eclipse
Could you not just hardlink to the /proc/<xxx>/fd/<y> file descriptor? I
haven't tried this, but considering you can `cp` from the open descriptor to a
new file, I should also think you could make a new hardlink to that same
descriptor.

~~~
LogicHoleFlaw
/proc is its own filesystem so its 'inodes' are incompatible with whatever FS
your disk is on.

~~~
nuclear_eclipse
Good catch. My hardcore Unix-fu is still lacking in places... =\

------
pmjordan
I've often wondered if there's a user-visible way of doing that. (the file
only disappears after the refcount hits 0 after all) Great find!

------
elq
this works on pretty much all unixes and recently saved my team's ass after a
3am finger fumble that unlinked a very important 500g file.

~~~
kragen
Last time I used them, none of the following Unixes had a /proc filesystem:
FreeBSD, NetBSD, IRIX, AIX, Ultrix, SunOS 4, MacOS X, NeXTStep. The only
Unixes I do know of that have it are Solaris (SunOS 5), Linux, and Plan 9,
which isn't really Unix.

~~~
cperciva
FreeBSD has a procfs, but it isn't mounted by default -- mostly due to its
unofficial name (rootmefs).

~~~
kragen
Thanks! I didn't know.

~~~
cperciva
Actually, I should elaborate slightly -- FreeBSD actually has two procfses,
the real one (procfs) and the one which is used for linux binary compatibility
(linprocfs). But neither of them is mounted by default.

------
andr
If it's open in an editor, click Save.

