Recover deleted files by using the file (occupation process) descriptor

Recover deleted files by using the file (occupation process) descriptor

(PS: The file is called by the process when it is started, or it is called by a process.) For example, a service writes a log file when it executes, and the log file is used by some process calls to log logs. ）

Now we simulate the state of the file (occupied process) being mistakenly deleted:

[[email protected] ~]# echo 123123 > A.txt[[email protected] ~]# cat A.txt123123[[email protected] ~]# tail-f a.txt 12 3123

(Use tail-f to always monitor the file so that the current file will have a process.) ）

Another window to delete the file

[Email protected]~]# rm-f a.txt [[email protected] ~]# Ls|grep a.txt

The file has now been confirmed to be deleted.

And then we get the file back.

[[email protected] ~]# ps -ef|grep tailroot        1674   1174 0 03:29 pts/1    00:00:00 tail - Fa.txtroot       1719   1633 0 03:38 pts/2     00:00:00 grep--color=auto tail[[email protected] ~]# lsof| grep deletebash      1174    root   6w       REG                 8,3        9      34549 /root/a.txt  (Deleted) tail      1674     root   6w      REG                 8,3        9     34549  /root/a.txt  (Deleted) tail      1674    root    7r      REG                 8,3        7       4066 /root/a.txt  (deleted) [[email protected] ~]# cat /proc/ 1674/fd/7123123

In this way, we find the deleted file content, and then just copy and paste into the file, OK.

The lookup location is the 7(file descriptor) in the directory of the tail process number 1674 in/proc/(the file Descriptorfolder ), i.e./ The Proc/1674/fd/7 file is the process that invokes the contents of the file you just created, so you can retrieve the contents of the file that you just mistakenly deleted.

This article is from the "Rookie Linux History" blog, make sure to keep this source http://jackdady.blog.51cto.com/8965949/1693214

Recover deleted files by using the file (occupation process) descriptor