Use Lsof in Linux to restore accidentally deleted files

How to Use Lsof to restore accidentally deleted files in Linux: stores the Directory and name of the process in the/proc partition of Linux, including fd (file descriptor) and its sub-directories (links to process open files), if a file is deleted, there is also an inode reference:/proc/process number/fd/file descriptor. We only need to know the process pid and file descriptor fd of the currently opened file, and we can use the lsof tool to list the files opened by the process. Www.2cto.com 1. filter the ls manual to the local file ls.txt and use more to view it. CTRL + Z to pause viewing. 1: [root @ localhost script] # man ls | col-B> ls.txt 2: [root @ localhost script] # more ls.txt 3: LS (1) User Commands LS (1) 4: 1: [1] + Stopped more ls.txt 2: [root @ localhost script] #3: [root @ localhost script] # jobs 4: [1] + Stopped more ls.txt 5: www.2cto.com 2. If you accidentally delete the file ls.txt 1: [root @ localhost script] # rm ls.txt 2: rm: whether to delete a common file" Ls.txt "? Y www.2cto.com 3. Use lsof to locate process 6511 and copy and restore. This file is valid only when this file is used or called. 3: [root @ localhost script] # lsof | grep ls.txt 4: more 6511 root 3r REG 253,0 7300 1083699/opt/script/ls.txt (deleted) 5: www.2cto.com 1: [root @ localhost script] # ls-l/proc/6511/fd/2: 0 1 2 3 3: [root @ localhost script] # ls-l/proc/6511/fd/3 4: lr-x ------ 1 root 64 10-30/proc/6511/fd/3->/opt/script/ls.txt (deleted) 5: 1: cp/proc/6511/fd/3 ls.txt. saved 2: