Re: 'Undeleting' an open file

[Jose Celestino <japc@co.sapo.pt>]

Words by Giuseppe Bilotta [Fri, Oct 07, 2005 at 04:14:27PM +0200]:
> On Wed, 5 Oct 2005 23:05:34 +0200 (CEST), Bodo Eggert wrote:
> 
> > Files are deleted if the last reference is gone. If you play a music file
> > and unlink it while it's playing, it won't be deleted untill the player
> > closes the file, since an open filehandle is a reference.
> 
> BTW, I've always wondered: is there a way to un-unlink such a file?
> 

Well, you can go to /proc/$PID_OF_PROCESSING_OPENING_THE_FILE/fd/

do an ls -la, identify the fd of the file deleted but still open
and do a cp $FD ~/my_deleted_file

Example:

[japc@morgoth:/proc/3743/fd]$ ls -al
total 4
dr-x------  2 japc japc  0 Oct  7 15:25 .
dr-xr-xr-x  4 japc japc  0 Oct  7 15:23 ..
lr-x------  1 japc japc 64 Oct  7 15:25 0 -> /dev/null
l-wx------  1 japc japc 64 Oct  7 15:25 1 -> /home/japc/.xsession-errors
l-wx------  1 japc japc 64 Oct  7 15:25 2 -> /home/japc/.xsession-errors
lr-x------  1 japc japc 64 Oct  7 15:25 255 -> /usr/bin/startkde
[japc@morgoth:/proc/3743/fd]$ cp 255 ~/startkde


-- 
Jose Celestino | http://xpto.org/~japc/files/japc-pgpkey.asc
----------------------------------------------------------------
"Thus the metric system did not really catch on in the States, unless you count
the increasing popularity of the nine-millimeter bullet." -- Dave Barry