Recovering a Deleted Open File

[Daniel Hedlund]

On Wed, Jul 7, 2010 at 05:57, Mike Kallies <mike.kallies-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org> wrote:
> I'm concerned that the gzip will run out of space, the process will drop
> its file handle and the file will be freed.  So I did a ctrl-z to stop
> the process, and checked the open files.  It's still there, all is good.

The filehandle should only be dropped once gzip is finished using it
or gzip itself exits.  If you make sure that there is enough space
left on the filesystem for it to finish, you should be alright.


> sooo... how do I give a handle back to /home/mike/Win2k3-d.tar ?
> root at x24:~# lsof | grep Win2k3-d.tar
> gzip       2700        mike    3r      REG      254,1 9011978240
> 343840 /home/mike/Win2k3-d.tar (deleted)

Open filehandles associated with a process are available in the
/proc/<pid>/fd/ directory:
$> ls -l /proc/2700/fd

One of the filehandles in the list should show that it points to
"/home/mike/Win2k3-d.tar (deleted)".  Based on your output of lsof
("3r"), it's going to be filehandle 3.  Trying to create a new
hardlink to the deleted file descriptor won't work as hard-linking
doesn't work across filesystems and the program isn't smart enough to
realize the data is actually on the same device.  There are programs
that can re-establish a link based on an inode number (9011978240 in
your case), but I'm not sure of one off the top of my head.

The easiest way to get the original file back is going to be making a
copy of the file /proc using something like:
$> cp /proc/2700/fd/3 /home/mike/Win2k3-d.tar

However, if you're concerned about running out of space then you might
need to copy the file to another device or make sure you clear enough
space.

Hope that helps.


Daniel Hedlund
daniel-fKF+LmlhkCtg9hUCZPvPmw at public.gmane.org
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists