19 November 2006
Recover deleted files on Linux
Those using Linux, especially the command line, have I'm sure all experienced that sinking feeling after having typed rm . Recently a possible method of getting those files back has been described.
The command lsof can help you find the data inside of /proc which can be copied back. This does rely on the file currently being currently opened. If any application or process that is using the file stops, the file is lost. If the file is being used though, from the command line you can type:
lsof | grep
This will give you data about the file. The most important is the second column which is the process id of the process using the file and the fourth column which is the file descriptor. Once you have that information type:
cp /proc//fd/
This will rescue the file with very little difficulty. Unfortunately this is only good for the times when the file is still opened.
The command lsof can help you find the data inside of /proc which can be copied back. This does rely on the file currently being currently opened. If any application or process that is using the file stops, the file is lost. If the file is being used though, from the command line you can type:
lsof | grep
This will give you data about the file. The most important is the second column which is the process id of the process using the file and the fourth column which is the file descriptor. Once you have that information type:
cp /proc/
This will rescue the file with very little difficulty. Unfortunately this is only good for the times when the file is still opened.
