Linux Ask!

Linux Ask! is a Q & A web site specific for Linux related questions. Questions are collected, answered and audited by experienced Linux users.

Jul 152012

How to recover a deleted file (but still being opened) in Linux?


If you have a file which is deleted but is still opening in another program, it is possible to recover it.

Let do a quick experiment:

# echo "hello" > /tmp/test.txt
# less /tmp/test.txt # Open this file

Now, in another terminal, we delete it

# rm /tmp/test.txt

To recover it, we need to find the pid of the program (less in our example) which is opening this file

# ps ax | grep less
31314 pts/0    S+     0:00 less test

Then we list the file descriptor being used by this program

# ls -l /proc/31314/fd

lr-x------ 1 joe joe 64 2012-07-05 08:56 4 -> /tmp/test (deleted)

Finally we can easily recover the content by

# cp /proc/31314/fd/4 /tmp/test.txt

  One Response to “How to recover a deleted file (but still being opened) in Linux?”

  1. [...] Normally you would remove a file by using the rm command, but what if you want to make sure the file is removed securely which prevent other people from recovering it? [...]

 Leave a Reply



You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>