Use lsof to recover rm-rf deleted files

In the Linux system using rm-rf Delete files, in fact, the file is only removed from the disk, the file content or in the background of the system to wait for recycling, you can use the system process number to test the file, the content will not be changed.

1. Delete a file

[email protected] logs]# ll Access.log
-rw-r--r--1 root root 11723908 June 16:02 Access.log
[Email protected] logs]# RM-RF Access.log

2. View files in the background process
[[email protected] logs]# lsof  | grep Delete | grep access
nginx      1212   root    9u   REG  202,1    11723908   274125/usr/local/nginx-1.4.7/logs/access.log (deleted)
nginx      9 w   reg  202,1   11723908   274125/usr/local/nginx-1.4.7/logs/access.log (deleted)
nginx     12954    www  9w   reg     202,1   11723908      274125/usr/local/nginx-1.4.7/logs/access.log (deleted)
[[email protected] logs]#

3. Copy the file from the process to disk

[Email protected] logs]# cp/proc/12953/fd/9 . #12953是进程号, 9 is a file descriptor
[Email protected] logs]# Du-sh 9
12M 9
[email protected] logs]# Cat 9 #文件内容看到了

This article is from the "Days Together" blog, please be sure to keep this source http://tongcheng.blog.51cto.com/6214144/1789173

Use lsof to recover rm-rf deleted files