Advertisement
pbhj

recovering deleted files that still have handles

Jun 25th, 2014
356
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 1.02 KB | None | 0 0
  1. user@host:~/tmp$ cp tmpfile{.orig,}
  2. user@host:~/tmp$ less tmpfile
  3.     ### ctrl+z was pressed ###
  4. [1]+  Stopped                 less tmpfile
  5. user@host:~/tmp$ stat tmpfile
  6.   File: โ€˜tmpfileโ€™
  7.   Size: 3145            Blocks: 8          IO Block: 4096   regular file
  8. Device: fc00h/64512d    Inode: 9708677     Links: 1
  9. Access: (0664/-rw-rw-r--)  Uid: ( 1000/  pandfi)   Gid: ( 1000/  pandfi)
  10. Access: 2014-06-26 00:01:47.421591000 +0100
  11. Modify: 2014-06-26 00:01:42.389591000 +0100
  12. Change: 2014-06-26 00:01:42.389591000 +0100
  13.  Birth: -
  14. user@host:~/tmp$ rm tmpfile
  15. user@host:~/tmp$ lsof | grep tmpfile
  16. less      6143          pandfi    4r      REG              252,0       3145  9708677 /home/pandfi/tmp/tmpfile (deleted)
  17. user@host:~/tmp$ cp /proc/6143/fd/4 tmpfile.recovered
  18. user@host:~/tmp$ diff tmp
  19. tmpfile.orig       tmpfile.recovered  
  20. user@host:~/tmp$ diff tmpfile.orig tmp
  21. tmpfile.orig       tmpfile.recovered  
  22. user@host:~/tmp$ diff -s tmpfile.orig tmpfile.recovered
  23. Files tmpfile.orig and tmpfile.recovered are identical
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement