Re: undelete still opened file

["Manish Katiyar" <mkatiyar@gmail.com>]

On Fri, Oct 17, 2008 at 3:38 PM, Lars Täuber <taeuber@bbaw.de> wrote:
> Hi there!
>
> If this should be the wrong mailing list please excuse me but I didn't find any better suiting.
> I just subscribed after unsuccessfully searching on the net for an answer to my question.
>
> Is it possible to undelete an accidentally deleted file that is still opened by a process?
> As far as I know the file is not really deleted as long there is a file descriptor connected to the file.
> I thought about something in connection with /proc/####/fd/# .
> Is there any chance to get the file back to normal?

To some extent yes......

>
> - Linux 2.6.[12]x
> - ext3 or nfs (should be independent of fs, wouldn't it?)

It is tightly coupled with the filesystem. So depending on your
filesystem you may or may not get it.

LOGFS (or any log structured file system) : They generally have
snapshots or some kind of file versioning. So you can retreive it from
there.

ext2 : After deletion ext2 doesn't zero the block pointers. So it is
possible to get it from there using debugfs.

ext3 : Search google for "Carlo wood + ext3grep"

ext4 : I don't know of any method ...

You can try the /proc/****/fd/** approach . It has worked for me in
past......but that was for a running binary. I am not sure about
shellscript kind of thing. There are some other tools too to recover ,
unfortunately I don't remember the name but google should be good
enough.

Thanks -
Manish



>
>
> Thanks and best regards.
> Lars
>
>
> PS: Sorry for my english.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html