Fast undelete for every linux filesystem

written by Admin


Posted on 2015-07-10


Problem

Panic! ...I have deleted a very important file on a filesystem that I cannot unmount or put in readonly mode (or formatted with a strange filesystem, without an undelete utility).

Solution

If a process opened the deleted file, you can use this procedure to immediately recover every byte of the deleted file.

First, check if some process has a file-descriptor pointing to the deleted file:
# lsof | grep "/directory/file"
processname 33322 user 9r REG 8,5 1293520 1299346 /directory/file

Good! ...you can start the recovery process (it is very fast because you copy the file from memory):
# cp /proc/33322/fd/9 /directory/recovered-file-name

P.S. you use the informations returned from the first command to generate the second.

Please tell me if it can recover files also on Mac.

Feedback


Leave a Comment:


Search

Categories

android x 1
apache x 1
apple x 4
backup x 2
cygwin x 1
dns x 1
dos x 1
drupal x 3
ftp x 1
iis x 1
imap x 1
linux x 22
mail x 4
mysql x 3
oracle x 1
pop3 x 1
print x 2
proxy x 1
rsync x 1
shell x 8
smtp x 1
squid x 1
ssh x 1
storage x 2
web x 3
windows x 15

Welcome

We need collaboration and a real boost from our community: write us an email for every trick you find!

This website is a sysadmin swiss-knife for every-day Windows, Linux and Mac administration and troubleshooting

Our database grows if YOU send us your tips and trick as soon as you find them every day!