Recovering an unlink-ed, but still opened file
alex.burlyga.ietf alex.burlyga.ietf
alex.burlyga.ietf at gmail.com
Sat Nov 28 03:30:22 UTC 2015
fdescfs is no use here to:-( Is the file on NFS mount by any chance? Then
there is .nfsXXXXX files.
Alex.
On Nov 27, 2015 19:03, "Mikhail T." <mi+thun at aldan.algebra.com> wrote:
> On 27.11.2015 21:46, alex.burlyga.ietf alex.burlyga.ietf wrote:
>
> If you know which process and which file descriptor, should be able to
> just copy from /proc/<pid>/fd/<fd> to a file. I would try that first.
>
> I know this trick -- and even used it on Solaris once. It may work on
> Linux too. But not on FreeBSD:
>
> tail -f /var/log/messages > /var/tmp/l &
> [1] 13954
> mi at narawntapu:/usr/src (829) rm /var/tmp/l
> mi at narawntapu:/usr/src (830) ls -l /proc/13954/fd
> ls: /proc/13954/fd: No such file or directory
>
> Worse, our linprocfs does not support that either:
>
> mi at narawntapu:/usr/src (831) ls -l /compat/linux/proc/13954/fd
> lr--r--r-- 1 mi wheel 0 27 лис 22:00 /compat/linux/proc/13954/fd ->
> *unknown*
>
> Perhaps more importantly, even if the trick worked, it wouldn't have been,
> what I asked for -- it would've allowed me to create a copy of the file.
> I'd like to be able to restore access to the original -- so that, for
> example, whatever the process writes to it is still available, etc. Can
> that be done somehow? Thanks! Yours,
>
> -mi
>
>
>
More information about the freebsd-fs
mailing list