Recover Deleted Linux Files With lsof
2014-07-13 15:31
267 查看
One of the more neat things you can do with the versatile utility lsof is useit to recover a file you've just accidentally deleted.
A file in Linux is a pointer to an inode, which contains the filedata (permissions, owner and where its actual content lives on the disk). Deleting thefile removes the link, but not the inode itself - if another process has it open, theinode isn't released for writing until that process is done with it.To try this out, create a test text file, save it and then type lesstest.txt. Open another terminal window, and type rm testing.txt. If youtry ls testing.txt you'll get an error message. But! less still has areference to the file. So:
The important columns are the second one, which gives you the PID of the process that has thefile open (4607), and the fourth one, which gives you the file descriptor (4). Now, we golook in /proc, where there will still be a reference to the inode, from whichyou can copy the file back out:
Note: don't use the -a flag with cp, as this willcopy the (broken) symbolic link, rather than the actual file contents.
Now check the file to make sure you've got what you think you have, and you'redone!
FROM: http://www.linuxplanet.com/linuxplanet/tips/6767/1/
REF:
1. Finding open files with lsof
http://www.ibm.com/developerworks/aix/library/au-lsof.html
2. lsof – The most powerful, versitile, and underused Unix command http://www.benharold.com/?p=14
3. 15 Linux lsof Command Examples (Identify Open Files)
http://www.thegeekstuff.com/2012/08/lsof-command-examples/
A file in Linux is a pointer to an inode, which contains the filedata (permissions, owner and where its actual content lives on the disk). Deleting thefile removes the link, but not the inode itself - if another process has it open, theinode isn't released for writing until that process is done with it.To try this out, create a test text file, save it and then type lesstest.txt. Open another terminal window, and type rm testing.txt. If youtry ls testing.txt you'll get an error message. But! less still has areference to the file. So:
> lsof | grep testing.txt less 4607 juliet 4r REG 254,4 21 8880214 /home/juliet/testing.txt (deleted) |
> ls -l /proc/4607/fd/4 lr-x------ 1 juliet juliet 64 Apr 7 03:19 /proc/4607/fd/4 -> /home/juliet/testing.txt (deleted) > cp /proc/4607/fd/4 testing.txt.bk |
Now check the file to make sure you've got what you think you have, and you'redone!
FROM: http://www.linuxplanet.com/linuxplanet/tips/6767/1/
REF:
1. Finding open files with lsof
http://www.ibm.com/developerworks/aix/library/au-lsof.html
2. lsof – The most powerful, versitile, and underused Unix command http://www.benharold.com/?p=14
3. 15 Linux lsof Command Examples (Identify Open Files)
http://www.thegeekstuff.com/2012/08/lsof-command-examples/
相关文章推荐
- How to recover deleted files on Linux
- Linux恢复被删除的文件 How To Recover Deleted Files From Your Linux System
- Linux: Accessing Files With O_DIRECT
- Linux: working with text files
- Using Android Phone to recover SD card formatted with DD command under linux
- HOWTO recover deleted files on an ext3 file system
- git - Restore locally deleted files with git
- recover all files with git
- How To Encrypt Files in Linux with eCryptfs
- How to Recover an SD Card With Linux
- HOWTO recover deleted files on an ext3 file system
- Finding open files with lsof
- 15 Linux lsof Command Examples (Identify Open Files)
- Finding open files with lsof
- recover all files with git
- How do you search for files containing dos line endings (CRLF) with grep on Linux?
- windows share files with linux via vitrualbox
- 基于POSIX在Linux下C语言实现读取整个目录文件[Get a List of Files in a Directory with C]
- How to Recover from a Lost or Deleted Datafile with Different Scenarios [ID 198640.1]
- Working with Linux Files and Folders in Bash