Joey Hess wrote:
Raj Kiran Grandhi wrote:
If I have accidentally deleted a file that is still being used by some
application (read or write mode), is it possible to recover such a file?
Especially since the file is not really deleted until the descriptor is
closed by the application?
Just wondering...
Yes, get the pid of the process that has the file open, then go to
/proc/PID/fd/
[EMAIL PROTECTED]:/proc/19553/fd>dir
total 0
dr-x------ 2 joey joey 0 May 8 00:36 ./
dr-xr-xr-x 6 joey joey 0 May 8 00:36 ../
lrwx------ 1 joey joey 64 May 8 00:36 0 -> /dev/pts/10
lrwx------ 1 joey joey 64 May 8 00:36 1 -> /dev/pts/10
lrwx------ 1 joey joey 64 May 8 00:36 2 -> /dev/pts/10
lr-x------ 1 joey joey 64 May 8 00:36 6 -> /home/joey/foo~\ (deleted)
[EMAIL PROTECTED]:/proc/19553/fd>cat 6 >~/foo
Cool! Thanks for that. I had noticed those links but did not think of
cat'ing a broken symbolic link.
--
Raj Kiran Grandhi
--
Politics is for the moment. An equation is for eternity.
-- Albert Einstein
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
