Shulou(Shulou.com)06/02 Report--

This article shows you how to use lsof to recover deleted files in Linux, the content is concise and easy to understand, it can definitely brighten your eyes. I hope you can get something through the detailed introduction of this article.

Create a new file:

/ > cd / tmp

Tmp > ls-lR / > / tmp/myfile

Tmp > ls-l myfile

-rw-r--r-- 1 fred ftp 11567585 Nov 23 08:44 myfile

Tmp > stat myfile

File: `myfile'Size: 11567585Blocks: 22640IO Block: 4096 regular fileDevice: 900h/2304dInode: 48871Links: 1Access: (0644) Uid: (1900/fred) Gid: (50/ftp) Access: 2006-11-23 08VV 4432.000000000 + 0000Modify: 200611-23 08VRV 44VRV 26.000000000 + 0000 Change: 2006-11-2308VRV 4426.0000000 + 0000

Execute some commands to keep the file open:

Scum 97 tmp > less myfile &

[1] + Suspended (tty output) less myfile

Delete files "suddenly":

Tmp > rm myfile

Tmp > ls-l myfile

Ls: myfile: No such file or directory

Use lsof to view the process of opening the file descriptor:

Tmp > lsof | grep myfile

Less11230fred4rREG9,0 1156758548871 / tmp/myfile (deleted)

The second column is the process PID that opens the file, and the fourth column is the process open file descriptor.

Locate the open file descriptor under / proc

Tmp > ls-l / proc/11230/fd/4

Lr-x- 1 fred ftp 64 Nov 23 08:49 / proc/11230/fd/4-> / tmp/myfile (deleted)

At this point, the file can be copied back to its original location:

Tmp > cp / proc/11230/fd/4 myfile

Tmp > ls-l myfile

-rw-r--r-- 1 fred ftp 11567585 Nov 23 08:54 myfile

Tmp > stat myfile

File: `myfile'Size: 11567585Blocks: 22640IO Block: 4096 regular fileDevice: 900h/2304dInode: 48878Links: 1Access: (0644) Uid: (1900/fred) Gid: (50/ftp) Access: 2006-11-23 08Vista 54VV 28.000000000 + 0000Modify: 200611-23 08VOV 54VOV 28.000000000 + 0000 Change: 2006-11-23 08For 54VON0000000 + 0000

Note:

The copied file is different from the file inode opened by the process, which means that the program's changes to the original file will not be restored after it is copied.

The above is how to use lsof to recover deleted files in Linux. Have you learned any knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.