The method of using lsof to recover mistakenly deleted files under Linux

Source: Internet
Author: User

Rationale: The directory and name of the process are stored under the/proc partition of the Linux system, containing the FD (file descriptor) and the subdirectory under it (the link to the process open file), and if a file is deleted, there is also a reference to the Inode:/proc/process number/fd/file descriptor. All we need to know is that the process PID and file descriptor FD for the currently open file can use the Lsof tool to list the files that the process opens.

First, the LS manual filter out the main control and redirect to File Ls.txt, and more view, CTRL + Z Pause view operation

1: [Root@localhost script]# man ls |col-b > Ls.txt

2: [Root@localhost script]# more Ls.txt

3:ls (1) User Commands LS (1)


1: [1]+ Stopped more Ls.txt

2: [Root@localhost script]#

3: [Root@localhost script]# jobs

4: [1]+ Stopped more Ls.txt


Second, the hypothesis mistakenly deletes the document Ls.txt

1: [Root@localhost script]# RM ls.txt

2:RM: Do you want to delete the generic file "Ls.txt"? Y

Third, using lsof to find the process 6511, and copy recovery, only if this file is used or invoked in the case of the effective

3: [root@localhost script]# lsof |grep ls.txt

4:more 6511 Root 3r REG 253,0 7300 1083699/opt/script/ls.txt (Deleted)


1: [Root@localhost script]# ls-l/proc/6511/fd/

2:0 1 2 3

3: [Root@localhost script]# ls-l/PROC/6511/FD/3

4:lr-x------1 root 10-30 21:21/proc/6511/fd/3->/opt/script/ls.txt (Deleted)


1:CP/PROC/6511/FD/3 ls.txt.saved

Related Article

E-Commerce Solutions

Leverage the same tools powering the Alibaba Ecosystem

Learn more >

11.11 Big Sale for Cloud

Get Unbeatable Offers with up to 90% Off,Oct.24-Nov.13 (UTC+8)

Get It Now >

Alibaba Cloud Free Trial

Learn and experience the power of Alibaba Cloud with a free trial worth $300-1200 USD

Learn more >

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.