$ cat important_file > /dev/null &
[1] 9711
$ rm important_file
$ killall -STOP cat
[1]+ Stopped cat important_file > /tmp/p
$ ls -l /proc/`pidof cat`/fd/
total 0
lrwx------ 1 vi vi 64 May 13 20:32 0 -> /dev/pts/29
l-wx------ 1 vi vi 64 May 13 20:32 1 -> /tmp/p
lrwx------ 1 vi vi 64 May 13 20:32 2 -> /dev/pts/29
lr-x------ 1 vi vi 64 May 13 20:32 3 -> /home/vi/important_file (deleted)
How to recover this important_file
?
I tried something like
injcode -m dup2 -ofd=3 -ofilename=/tmp/recovered_file -oflags=O_CREAT $PID_OF_CAT
but it does nothing.
Answer
If /home is NFS, there will be a .nfsNNNNNNNNNN file in /home/vi that you can access/copy. If home is a local filesystem, you should be able to do the same thing via the /proc/PID/fd/3 link:
cp /proc/PID/fd/3 /tmp/recovered_file
If you want to actually undelete the file, here's a blog post on the subject.
Comments
Post a Comment