Recovering an unlink-ed, but still opened file

[alex.burlyga.ietf alex.burlyga.ietf]

fdescfs is no use here to:-( Is the file on NFS mount by any chance? Then
there is .nfsXXXXX files.

Alex.
On Nov 27, 2015 19:03, "Mikhail T." <mi+thun at aldan.algebra.com> wrote:

> On 27.11.2015 21:46, alex.burlyga.ietf alex.burlyga.ietf wrote:
>
> If you know which process and which file descriptor, should be able to
> just copy from /proc/<pid>/fd/<fd> to a file. I would try that first.
>
> I know this trick -- and even used it on Solaris once. It may work on
> Linux too. But not on FreeBSD:
>
> tail -f /var/log/messages > /var/tmp/l &
> [1] 13954
> mi at narawntapu:/usr/src (829) rm /var/tmp/l
> mi at narawntapu:/usr/src (830) ls -l /proc/13954/fd
> ls: /proc/13954/fd: No such file or directory
>
> Worse, our linprocfs does not support that either:
>
> mi at narawntapu:/usr/src (831) ls -l /compat/linux/proc/13954/fd
> lr--r--r--  1 mi  wheel  0 27 лис 22:00 /compat/linux/proc/13954/fd ->
> *unknown*
>
> Perhaps more importantly, even if the trick worked, it wouldn't have been,
> what I asked for -- it would've allowed me to create a copy of the file.
> I'd like to be able to restore access to the original -- so that, for
> example, whatever the process writes to it is still available, etc. Can
> that be done somehow? Thanks! Yours,
>
> -mi
>
>
>