undeleting files that are still open
Posted 06-10-2012 at 09:28 PM by neonsignal
Normally it is tricky to recover a file that has just been deleted, but if the file is open by an application, its node still exists on the filesystem.
First find out the process id of the application:
Then list all the files that the application has open:
The ones that are to be recovered can be copied:
First find out the process id of the application:
Code:
ps -e | grep application-name
Code:
ls -l /proc/process-id/fd/
Code:
cp /proc/process-id/fd/file-number filename
Total Comments 0