How to undelete any open, deleted file on linux / solaris

Chris Dew wrote up a neat trick on how to recover files if deleted on Linux, yet still open by a process.

This works on Solaris as well.  =)

$:~:uname -a
SunOS somehost.com 5.10 Generic_127112-11 i86pc i386 i86pc

$:~:echo “sup prefetch.net folks?” > testfile
$:~:tail -f testfile &
[1] 17134

$:~:rm testfile
$:~:ls /proc/17134/fd/
0  1  2
$:~:cat /proc/17134/fd/0
sup prefetch.net folks?
$:~:cp !$ ./testfile
cp /proc/17134/fd/0 ./testfile
$:~:cat testfile
sup prefetch.net folks?

3 thoughts on “How to undelete any open, deleted file on linux / solaris”

  1. Hello,
    A little note – file descriptor zero usually points to standard input (STDIN). In case of ‘tail’ – file descriptor will be 3 as it is first free number after 0 (STDIN), 1 (STDOUT) and 2 (STDERR).

  2. Minor semantic nit, but this isn’t really *undeleting* a file but rather (and as you more correctly put it) *recovering* a file. The problem here is that you can get the contents of the file up to the point that you copied it. If the process is still writing to the file (say a log file), you’d need to catch it between the last write and the process closing the file in order to know that you’d gotten it all.

    The nifty trick would be reattaching the inodes to the filesystem. I tried doing this with fsdb (http://cmynhier.blogspot.com/2007/05/re-linking-unlinked-file-with-fsdb.html), but it’s neither practical nor portable. The ideal situation would be an option to ln(1) to specify an inode rather than a filename.

  3. “ln -L /proc/$PID/fd/$FD $orig_name” workes for me as an actual undeleting. for a simple .txt file this might not be a problem, but for a couple GB this might not just for the size, but also for the time needed when copying.

Leave a Reply

Your email address will not be published. Required fields are marked *