Comments on: How to undelete any open, deleted file on linux / solaris http://prefetch.net/blog/index.php/2009/02/25/how-to-undelete-any-open-deleted-file-on-linux-solaris/ Blog O' Matty Tue, 07 Feb 2012 02:31:44 +0000 hourly 1 By: cj http://prefetch.net/blog/index.php/2009/02/25/how-to-undelete-any-open-deleted-file-on-linux-solaris/comment-page-1/#comment-830159 cj Tue, 15 Feb 2011 23:53:23 +0000 http://prefetch.net/blog/?p=1060#comment-830159 "ln -L /proc/$PID/fd/$FD $orig_name" workes for me as an actual undeleting. for a simple .txt file this might not be a problem, but for a couple GB this might not just for the size, but also for the time needed when copying. “ln -L /proc/$PID/fd/$FD $orig_name” workes for me as an actual undeleting. for a simple .txt file this might not be a problem, but for a couple GB this might not just for the size, but also for the time needed when copying.

]]> By: Chad http://prefetch.net/blog/index.php/2009/02/25/how-to-undelete-any-open-deleted-file-on-linux-solaris/comment-page-1/#comment-670855 Chad Thu, 26 Feb 2009 11:45:21 +0000 http://prefetch.net/blog/?p=1060#comment-670855 Minor semantic nit, but this isn't really *undeleting* a file but rather (and as you more correctly put it) *recovering* a file. The problem here is that you can get the contents of the file up to the point that you copied it. If the process is still writing to the file (say a log file), you'd need to catch it between the last write and the process closing the file in order to know that you'd gotten it all. The nifty trick would be reattaching the inodes to the filesystem. I tried doing this with fsdb (http://cmynhier.blogspot.com/2007/05/re-linking-unlinked-file-with-fsdb.html), but it's neither practical nor portable. The ideal situation would be an option to ln(1) to specify an inode rather than a filename. Minor semantic nit, but this isn’t really *undeleting* a file but rather (and as you more correctly put it) *recovering* a file. The problem here is that you can get the contents of the file up to the point that you copied it. If the process is still writing to the file (say a log file), you’d need to catch it between the last write and the process closing the file in order to know that you’d gotten it all.

The nifty trick would be reattaching the inodes to the filesystem. I tried doing this with fsdb (http://cmynhier.blogspot.com/2007/05/re-linking-unlinked-file-with-fsdb.html), but it’s neither practical nor portable. The ideal situation would be an option to ln(1) to specify an inode rather than a filename.

]]> By: Dmitry http://prefetch.net/blog/index.php/2009/02/25/how-to-undelete-any-open-deleted-file-on-linux-solaris/comment-page-1/#comment-670851 Dmitry Thu, 26 Feb 2009 10:21:57 +0000 http://prefetch.net/blog/?p=1060#comment-670851 Hello, A little note - file descriptor zero usually points to standard input (STDIN). In case of 'tail' - file descriptor will be 3 as it is first free number after 0 (STDIN), 1 (STDOUT) and 2 (STDERR). Hello,
A little note – file descriptor zero usually points to standard input (STDIN). In case of ‘tail’ – file descriptor will be 3 as it is first free number after 0 (STDIN), 1 (STDOUT) and 2 (STDERR).

]]>