Wednesday, June 22, 2011

Recover deleted files from Linux when processes are running

This morning I was running a big simulation and I decided to rsync my files through the computers at the office. It was late when I realized that I forgot to exclude the simulation's log file, and so this file was deleted from one of the running machines.

When a file is deleted, its name disappears from the file system, but the information is still being saved as long as the simulation is running. So in order to recover the information, I had to identify the PID of the simulation:

$ pgrep larva
18218

Then I had to look for the files opened by the program:

$ ls -l /proc/18218/fd
0 -> /dev/null
1 -> /home/facorread/prog/larva.log (deleted)
2 -> /home/facorread/prog/larva.log (deleted)
3 -> /home/facorread/prog/larva.csv
5 -> pipe:[288212]

Now I can save the log to another file or just read how the program is going using commands such as

$ tail /proc/18218/fd/2
Thanks to Michael Stutz for his remarks on file recovery.

No comments:

Post a Comment

Is your comment or question:

1. Constructive?
2. Interesting?
3. Short?

If not, please post it in your own blog.