Recover deleted files by using the file (occupation process) descriptor
(PS: The file is called by the process when it is started, or it is called by a process.) For example, a service writes a log file when it executes, and the log file is used by some process calls to log logs. )
Now we simulate the state of the file (occupied process) being mistakenly deleted:
[[email protected] ~]# echo 123123 > A.txt[[email protected] ~]# cat A.txt123123[[email protected] ~]# tail-f a.txt 12 3123
(Use tail-f to always monitor the file so that the current file will have a process.) )
Another window to delete the file
[Email protected]~]# rm-f a.txt [[email protected] ~]# Ls|grep a.txt
The file has now been confirmed to be deleted.
And then we get the file back.
[[email protected] ~]# ps -ef|grep tailroot 1674 1174 0 03:29 pts/1 00:00:00 tail - Fa.txtroot 1719 1633 0 03:38 pts/2 00:00:00 grep--color=auto tail[[email protected] ~]# lsof| grep deletebash 1174 root 6w REG 8,3 9 34549 /root/a.txt (Deleted) tail 1674 root 6w REG 8,3 9 34549 /root/a.txt (Deleted) tail 1674 root 7r REG 8,3 7 4066 /root/a.txt (deleted) [[email protected] ~]# cat /proc/ 1674/fd/7123123
In this way, we find the deleted file content, and then just copy and paste into the file, OK.
The lookup location is the 7(file descriptor) in the directory of the tail process number 1674 in/proc/(the file Descriptorfolder ), i.e./ The Proc/1674/fd/7 file is the process that invokes the contents of the file you just created, so you can retrieve the contents of the file that you just mistakenly deleted.
This article is from the "Rookie Linux History" blog, make sure to keep this source http://jackdady.blog.51cto.com/8965949/1693214
Recover deleted files by using the file (occupation process) descriptor