Restore deleted while unclosed File

Scenario: accidentally deleted a file, but the file was opened by a process (such as a daemon) and not closed yet.

Note: deleting a file occurs after all open FD files are closed. That is, after unlink a file, if the reference count of inode is reduced to 0, the file should be deleted, however, if a process has opened the file and is not closed (that is, the open count is not 0), the file will be deleted after the last process that opened the file closes the FD of the file.

This is why the install command is used. Install will first unlink the file, and then open the file with the same file name (actually create) and write the file; correspondingly, the CP command opens the file and writes it directly. Install the new version of the shared library. so file, because. so files may already be used by many processes. If you open and write them directly (CP), these processes may crash afterwards. If you use Install, A new file with the same path will be created (the new file refers to different inode). The original file will be automatically deleted after all open processes close the file FD.

To put it bluntly, assume that a process has opened the file and has not closed it.

1. CD/proc/Pid/FD of that Process

2. Locate the file through LS-L.

3. CP to other places