Jul 152012
How to recover a deleted file (but still being opened) in Linux?
Answer:
If you have a file which is deleted but is still opening in another program, it is possible to recover it.
Let do a quick experiment:
# echo "hello" > /tmp/test.txt
# less /tmp/test.txt # Open this file
Now, in another terminal, we delete it
# rm /tmp/test.txt
To recover it, we need to find the pid of the program (less in our example) which is opening this file
# ps ax | grep less
31314 pts/0 S+ 0:00 less test
Then we list the file descriptor being used by this program
# ls -l /proc/31314/fd
lr-x------ 1 joe joe 64 2012-07-05 08:56 4 -> /tmp/test (deleted)
Finally we can easily recover the content by
# cp /proc/31314/fd/4 /tmp/test.txt