Recover Deleted Files

Files on Unix may be deleted, but still held open by another process. While most Unix would require a utility to read a file by the filesystem and inode(5) number, the special /proc filesystem on Linux allows the recovery of deleted but held open files:

1. Use lsof(1) to discover the deleted file, and record the Process ID (PID) and File Descriptor (FD) open to this file.
2. Recover the file: cp /proc/$PID/fd/$FD /var/tmp/recovered

The deleted file should appear as a broken symbolic link under the /proc/$PID/fd directory. Despite this, /proc still allows the file to be copied elsewhere. For related information, see how to debug Unix systems.

Technorati Tags: Unix