How to undelete any open, deleted file on linux / solaris

Chris Dew wrote up a neat trick on how to recover files if deleted on Linux, yet still open by a process.

This works on Solaris as well.  =)

$:~:uname -a
SunOS somehost.com 5.10 Generic_127112-11 i86pc i386 i86pc

$:~:echo “sup prefetch.net folks?” > testfile
$:~:tail -f testfile &
[1] 17134

$:~:rm testfile
$:~:ls /proc/17134/fd/
0  1  2
$:~:cat /proc/17134/fd/0
sup prefetch.net folks?
$:~:cp !$ ./testfile
cp /proc/17134/fd/0 ./testfile
$:~:cat testfile
sup prefetch.net folks?

mike on February 25, 2009 | Filed Under UNIX, UNIX Shell

2 Comments

Dmitry  on February 26th, 2009

Hello,
A little note – file descriptor zero usually points to standard input (STDIN). In case of ‘tail’ – file descriptor will be 3 as it is first free number after 0 (STDIN), 1 (STDOUT) and 2 (STDERR).

Chad  on February 26th, 2009

Minor semantic nit, but this isn’t really *undeleting* a file but rather (and as you more correctly put it) *recovering* a file. The problem here is that you can get the contents of the file up to the point that you copied it. If the process is still writing to the file (say a log file), you’d need to catch it between the last write and the process closing the file in order to know that you’d gotten it all.

The nifty trick would be reattaching the inodes to the filesystem. I tried doing this with fsdb (http://cmynhier.blogspot.com/2007/05/re-linking-unlinked-file-with-fsdb.html), but it’s neither practical nor portable. The ideal situation would be an option to ln(1) to specify an inode rather than a filename.

Leave a Comment