How to restore a deleted file while it's still being opened?
I tried
xtricman⚓ArchVirtual⏺️~🤐ls /proc/self/fd/ -l
Total 0
lrwx------ 1 xtricman users 64 1月 16 16:34 0 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 1 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 2 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 3 -> '/home/xtricman/a (deleted)'
lr-x------ 1 xtricman users 64 1月 16 16:34 4 -> /proc/1273/fd
xtricman⚓ArchVirtual⏺️~🤐ln /proc/self/fd/3 b
ln: failed to create hard link 'b' => '/proc/self/fd/3': Invalid cross-device link
Since the inode is still on the disk, how can I re-create a name for it? What if there's no open file description pointing to that inode but that inode is mmaped? How can I restore it in that case?
linux-kernel
asked yesterday
炸鱼薯条德里克炸鱼薯条德里克
431114
add a comment |
I tried
xtricman⚓ArchVirtual⏺️~🤐ls /proc/self/fd/ -l
Total 0
lrwx------ 1 xtricman users 64 1月 16 16:34 0 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 1 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 2 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 3 -> '/home/xtricman/a (deleted)'
lr-x------ 1 xtricman users 64 1月 16 16:34 4 -> /proc/1273/fd
xtricman⚓ArchVirtual⏺️~🤐ln /proc/self/fd/3 b
ln: failed to create hard link 'b' => '/proc/self/fd/3': Invalid cross-device link
Since the inode is still on the disk, how can I re-create a name for it? What if there's no open file description pointing to that inode but that inode is mmaped? How can I restore it in that case?
linux-kernel
asked yesterday
炸鱼薯条德里克炸鱼薯条德里克
431114
2
basically the same question as: unix.stackexchange.com/questions/92816/… tl;dr; you can't without hacks. read the lkml links from the answers there -- I don't think anything has changed since then.
– Uncle Billy
23 hours ago
add a comment |
I tried
xtricman⚓ArchVirtual⏺️~🤐ls /proc/self/fd/ -l
Total 0
lrwx------ 1 xtricman users 64 1月 16 16:34 0 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 1 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 2 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 3 -> '/home/xtricman/a (deleted)'
lr-x------ 1 xtricman users 64 1月 16 16:34 4 -> /proc/1273/fd
xtricman⚓ArchVirtual⏺️~🤐ln /proc/self/fd/3 b
ln: failed to create hard link 'b' => '/proc/self/fd/3': Invalid cross-device link
Since the inode is still on the disk, how can I re-create a name for it? What if there's no open file description pointing to that inode but that inode is mmaped? How can I restore it in that case?
linux-kernel
asked yesterday
炸鱼薯条德里克炸鱼薯条德里克
431114
I tried
xtricman⚓ArchVirtual⏺️~🤐ls /proc/self/fd/ -l
Total 0
lrwx------ 1 xtricman users 64 1月 16 16:34 0 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 1 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 2 -> /dev/pts/0
lrwx------ 1 xtricman users 64 1月 16 16:34 3 -> '/home/xtricman/a (deleted)'
lr-x------ 1 xtricman users 64 1月 16 16:34 4 -> /proc/1273/fd
xtricman⚓ArchVirtual⏺️~🤐ln /proc/self/fd/3 b
ln: failed to create hard link 'b' => '/proc/self/fd/3': Invalid cross-device link
Since the inode is still on the disk, how can I re-create a name for it? What if there's no open file description pointing to that inode but that inode is mmaped? How can I restore it in that case?
linux-kernel
linux-kernel
asked yesterday
炸鱼薯条德里克炸鱼薯条德里克
431114
asked yesterday
炸鱼薯条德里克炸鱼薯条德里克
431114
edited yesterday
炸鱼薯条德里克
asked yesterday
炸鱼薯条德里克炸鱼薯条德里克
431114
asked yesterday
炸鱼薯条德里克炸鱼薯条德里克
431114
asked yesterday
炸鱼薯条德里克炸鱼薯条德里克
431114
431114
2
basically the same question as: unix.stackexchange.com/questions/92816/… tl;dr; you can't without hacks. read the lkml links from the answers there -- I don't think anything has changed since then.
– Uncle Billy
23 hours ago
add a comment |
2
basically the same question as: unix.stackexchange.com/questions/92816/… tl;dr; you can't without hacks. read the lkml links from the answers there -- I don't think anything has changed since then.
– Uncle Billy
23 hours ago
2
2
basically the same question as: unix.stackexchange.com/questions/92816/… tl;dr; you can't without hacks. read the lkml links from the answers there -- I don't think anything has changed since then.
– Uncle Billy
23 hours ago
basically the same question as: unix.stackexchange.com/questions/92816/… tl;dr; you can't without hacks. read the lkml links from the answers there -- I don't think anything has changed since then.
– Uncle Billy
23 hours ago
add a comment |
1 Answer
1
active
oldest
votes
You could simply cat that file descriptor:
$ echo foo > bar
$ sleep 10m < bar & rm bar
[1] 15743
$ ls -l /proc/15743/fd
total 0
lr-x------ 1 olorin olorin 64 Jan 16 17:49 0 -> /tmp/bar (deleted)
lrwx------ 1 olorin olorin 64 Jan 16 17:49 1 -> /dev/pts/6
lrwx------ 1 olorin olorin 64 Jan 16 17:49 2 -> /dev/pts/6
$ cat /proc/15743/fd/0
foo
$ cat /proc/15743/fd/0 > bar
$ cat bar
foo
You can't ln that file to make a hard link because hard links can't span filesystems, and /proc is a virtual filesystem (procfs), and even within /proc, what you can do is restricted (the contents reflect the state of the kernel, so you can't perform arbitrary operations).
answered yesterday
OlorinOlorin
1,679212
But I want to restore the inode, not just duplicate the data.
– 炸鱼薯条德里克
yesterday
That's not going to be possible without hackery. Even tools which "undelete" files don't restore to the same inode.
– Olorin
10 hours ago
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f494760%2fhow-to-restore-a-deleted-file-while-its-still-being-opened%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You could simply cat that file descriptor:
$ echo foo > bar
$ sleep 10m < bar & rm bar
[1] 15743
$ ls -l /proc/15743/fd
total 0
lr-x------ 1 olorin olorin 64 Jan 16 17:49 0 -> /tmp/bar (deleted)
lrwx------ 1 olorin olorin 64 Jan 16 17:49 1 -> /dev/pts/6
lrwx------ 1 olorin olorin 64 Jan 16 17:49 2 -> /dev/pts/6
$ cat /proc/15743/fd/0
foo
$ cat /proc/15743/fd/0 > bar
$ cat bar
foo
You can't ln that file to make a hard link because hard links can't span filesystems, and /proc is a virtual filesystem (procfs), and even within /proc, what you can do is restricted (the contents reflect the state of the kernel, so you can't perform arbitrary operations).
answered yesterday
OlorinOlorin
1,679212
But I want to restore the inode, not just duplicate the data.
– 炸鱼薯条德里克
yesterday
That's not going to be possible without hackery. Even tools which "undelete" files don't restore to the same inode.
– Olorin
10 hours ago
add a comment |
You could simply cat that file descriptor:
$ echo foo > bar
$ sleep 10m < bar & rm bar
[1] 15743
$ ls -l /proc/15743/fd
total 0
lr-x------ 1 olorin olorin 64 Jan 16 17:49 0 -> /tmp/bar (deleted)
lrwx------ 1 olorin olorin 64 Jan 16 17:49 1 -> /dev/pts/6
lrwx------ 1 olorin olorin 64 Jan 16 17:49 2 -> /dev/pts/6
$ cat /proc/15743/fd/0
foo
$ cat /proc/15743/fd/0 > bar
$ cat bar
foo
You can't ln that file to make a hard link because hard links can't span filesystems, and /proc is a virtual filesystem (procfs), and even within /proc, what you can do is restricted (the contents reflect the state of the kernel, so you can't perform arbitrary operations).
answered yesterday
OlorinOlorin
1,679212
But I want to restore the inode, not just duplicate the data.
– 炸鱼薯条德里克
yesterday
That's not going to be possible without hackery. Even tools which "undelete" files don't restore to the same inode.
– Olorin
10 hours ago
add a comment |
You could simply cat that file descriptor:
$ echo foo > bar
$ sleep 10m < bar & rm bar
[1] 15743
$ ls -l /proc/15743/fd
total 0
lr-x------ 1 olorin olorin 64 Jan 16 17:49 0 -> /tmp/bar (deleted)
lrwx------ 1 olorin olorin 64 Jan 16 17:49 1 -> /dev/pts/6
lrwx------ 1 olorin olorin 64 Jan 16 17:49 2 -> /dev/pts/6
$ cat /proc/15743/fd/0
foo
$ cat /proc/15743/fd/0 > bar
$ cat bar
foo
You can't ln that file to make a hard link because hard links can't span filesystems, and /proc is a virtual filesystem (procfs), and even within /proc, what you can do is restricted (the contents reflect the state of the kernel, so you can't perform arbitrary operations).
answered yesterday
OlorinOlorin
1,679212
You could simply cat that file descriptor:
$ echo foo > bar
$ sleep 10m < bar & rm bar
[1] 15743
$ ls -l /proc/15743/fd
total 0
lr-x------ 1 olorin olorin 64 Jan 16 17:49 0 -> /tmp/bar (deleted)
lrwx------ 1 olorin olorin 64 Jan 16 17:49 1 -> /dev/pts/6
lrwx------ 1 olorin olorin 64 Jan 16 17:49 2 -> /dev/pts/6
$ cat /proc/15743/fd/0
foo
$ cat /proc/15743/fd/0 > bar
$ cat bar
foo
You can't ln that file to make a hard link because hard links can't span filesystems, and /proc is a virtual filesystem (procfs), and even within /proc, what you can do is restricted (the contents reflect the state of the kernel, so you can't perform arbitrary operations).
answered yesterday
OlorinOlorin
1,679212
answered yesterday
OlorinOlorin
1,679212
answered yesterday
OlorinOlorin
1,679212
answered yesterday
OlorinOlorin
1,679212
1,679212
But I want to restore the inode, not just duplicate the data.
– 炸鱼薯条德里克
yesterday
That's not going to be possible without hackery. Even tools which "undelete" files don't restore to the same inode.
– Olorin
10 hours ago
add a comment |
But I want to restore the inode, not just duplicate the data.
– 炸鱼薯条德里克
yesterday
That's not going to be possible without hackery. Even tools which "undelete" files don't restore to the same inode.
– Olorin
10 hours ago
But I want to restore the inode, not just duplicate the data.
– 炸鱼薯条德里克
yesterday
But I want to restore the inode, not just duplicate the data.
– 炸鱼薯条德里克
yesterday
That's not going to be possible without hackery. Even tools which "undelete" files don't restore to the same inode.
– Olorin
10 hours ago
That's not going to be possible without hackery. Even tools which "undelete" files don't restore to the same inode.
– Olorin
10 hours ago
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f494760%2fhow-to-restore-a-deleted-file-while-its-still-being-opened%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
basically the same question as: unix.stackexchange.com/questions/92816/… tl;dr; you can't without hacks. read the lkml links from the answers there -- I don't think anything has changed since then.
– Uncle Billy
23 hours ago