The method of using lsof to recover mistakenly deleted files under Linux

Rationale: The directory and name of the process are stored under the/proc partition of the Linux system, containing the FD (file descriptor) and the subdirectory under it (the link to the process open file), and if a file is deleted, there is also a reference to the Inode:/proc/process number/fd/file descriptor. All we need to know is that the process PID and file descriptor FD for the currently open file can use the Lsof tool to list the files that the process opens.

First, the LS manual filter out the main control and redirect to File Ls.txt, and more view, CTRL + Z Pause view operation

1: [Root@localhost script]# man ls |col-b > Ls.txt

2: [Root@localhost script]# more Ls.txt

3:ls (1) User Commands LS (1)

4:

1: [1]+ Stopped more Ls.txt

2: [Root@localhost script]#

3: [Root@localhost script]# jobs

4: [1]+ Stopped more Ls.txt

5:

Second, the hypothesis mistakenly deletes the document Ls.txt

1: [Root@localhost script]# RM ls.txt

2:RM: Do you want to delete the generic file "Ls.txt"? Y

Third, using lsof to find the process 6511, and copy recovery, only if this file is used or invoked in the case of the effective

3: [root@localhost script]# lsof |grep ls.txt

4:more 6511 Root 3r REG 253,0 7300 1083699/opt/script/ls.txt (Deleted)

5:

1: [Root@localhost script]# ls-l/proc/6511/fd/

2:0 1 2 3

3: [Root@localhost script]# ls-l/PROC/6511/FD/3

4:lr-x------1 root 10-30 21:21/proc/6511/fd/3->/opt/script/ls.txt (Deleted)

5:

1:CP/PROC/6511/FD/3 ls.txt.saved