Undelete files with lsof
If you delete a file by mistake, there are several ways to recover it.
I'm going to explain how to recover a file that has been deleted but still "active" on the system because locked by a running process.
First, let's create a file maintained by a lock.
$ watch ps aux > log.txt
Interrupt the process by hitting Ctrl+Z
ps reveals the "watch" command is still being executed but in T state (T = traced or suspended process).
$ ps aux | grep watch sw 19290 0.0 0.0 17660 3620 pts/14 T 11:09 0:00 watch ps aux
The process ID (PID) is 19290.
$ ls -l /proc/19290/fd total 0 lrwx------ 1 sw sw 64 Jan 21 11:10 0 -> /dev/pts/14 l-wx------ 1 sw sw 64 Jan 21 11:10 1 -> /home/sw/log.txt lrwx------ 1 sw sw 64 Jan 21 11:09 2 -> /dev/pts/14
Let's delete log.txt now
$ rm log.txt
We can now see log.txt has been deleted, but the lock is still active.
$ ls log.txt ls: cannot access log.txt: No such file or directory $ lsof -n | grep 19290 [...] watch 19290 sw 1w REG 8,6 7804 27151 /home/sw/log.txt (deleted) [...]
The interesting part here is "1w". It means it's the file descriptor number 1. The file can then be retrieved like this:
$ cp /proc/19290/fd/1 /home/sw/recover.txt
You can return the process in the foreground using "fg" and kill it.