How to use lsof to recover deleted files in Linux
This article shows you how to use lsof to recover deleted files in Linux, the content is concise and easy to understand, it can definitely brighten your eyes. I hope you can get something through the detailed introduction of this article.
Create a new file:
/ > cd / tmp
Tmp > ls-lR / > / tmp/myfile
Tmp > ls-l myfile
-rw-r--r-- 1 fred ftp 11567585 Nov 23 08:44 myfile
Tmp > stat myfile
File: `myfile'Size: 11567585Blocks: 22640IO Block: 4096 regular fileDevice: 900h/2304dInode: 48871Links: 1Access: (0644) Uid: (1900/fred) Gid: (50/ftp) Access: 2006-11-23 08VV 4432.000000000 + 0000Modify: 200611-23 08VRV 44VRV 26.000000000 + 0000 Change: 2006-11-2308VRV 4426.0000000 + 0000
Execute some commands to keep the file open:
Scum 97 tmp > less myfile &
[1] + Suspended (tty output) less myfile
Delete files "suddenly":
Tmp > rm myfile
Tmp > ls-l myfile
Ls: myfile: No such file or directory
Use lsof to view the process of opening the file descriptor:
Tmp > lsof | grep myfile
Less11230fred4rREG9,0 1156758548871 / tmp/myfile (deleted)
The second column is the process PID that opens the file, and the fourth column is the process open file descriptor.
Locate the open file descriptor under / proc
Tmp > ls-l / proc/11230/fd/4
Lr-x- 1 fred ftp 64 Nov 23 08:49 / proc/11230/fd/4-> / tmp/myfile (deleted)
At this point, the file can be copied back to its original location:
Tmp > cp / proc/11230/fd/4 myfile
Tmp > ls-l myfile
-rw-r--r-- 1 fred ftp 11567585 Nov 23 08:54 myfile
Tmp > stat myfile
File: `myfile'Size: 11567585Blocks: 22640IO Block: 4096 regular fileDevice: 900h/2304dInode: 48878Links: 1Access: (0644) Uid: (1900/fred) Gid: (50/ftp) Access: 2006-11-23 08Vista 54VV 28.000000000 + 0000Modify: 200611-23 08VOV 54VOV 28.000000000 + 0000 Change: 2006-11-23 08For 54VON0000000 + 0000
Note:
The copied file is different from the file inode opened by the process, which means that the program's changes to the original file will not be restored after it is copied.
The above is how to use lsof to recover deleted files in Linux. Have you learned any knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.
