Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a file that was deleted, but is still held open by a program. I found the inode number using lsof. How can I create a hard link back to that inode?

share|improve this question
add comment

3 Answers

up vote 29 down vote accepted

You can't create a link to it, but you can get it back. Let's do an experiment:

$ echo blurfl >myfile.txt
$ tail -f myfile.txt &
$ rm myfile.txt

myfile.txt is now gone, but the inode is kept alive by the tail command. To get your file back, first find the PID of the process keeping the inode:

$ ps auxw | grep tail
sunny      409  0.0  0.0   8532   824 pts/5    S    18:07   0:00 tail -f myfile.txt

The PID is 409. chdir to /proc/409/fd/ and list the contents:

dr-x------ 2 sunny sunny  0 2009-07-24 18:07:18 .
dr-xr-xr-x 7 sunny sunny  0 2009-07-24 18:07:17 ..
lrwx------ 1 sunny sunny 64 2009-07-24 18:07:33 0 -> /dev/pts/5
lrwx------ 1 sunny sunny 64 2009-07-24 18:07:33 1 -> /dev/pts/5
lrwx------ 1 sunny sunny 64 2009-07-24 18:07:18 2 -> /dev/pts/5
lr-x------ 1 sunny sunny 64 2009-07-24 18:07:33 3 -> /home/sunny/tmp/myfile.txt (deleted)

The /proc/[PID]/fd/ directories contain symlinks to file descriptors of all files the process uses. In this case the symlink "3" points to the deleted file. So, to restore the file, copy the contents to a new file:

$ cat 3 >/home/mydir/saved_file.txt
share|improve this answer
    
I've done this with a filesystem debugger in the distant past (e.g. "debugfs dump"), but the concept is the same. –  Gerald Combs Jul 24 '09 at 16:32
1  
nice answer, +1 –  asdmin Jul 24 '09 at 17:54
    
This doesn't work for me. Given that '3' is a dangling symlink, not a "real" file descriptor, it always just creates an empty file. –  Rob Chanter Aug 17 '09 at 2:53
4  
@Rob: No, it doesn't. If the file descriptor is in use, the symlink points to valid data, otherwise the symlink wouldn't exist in the first place. When the file is closed, the symlink disappears. You did have a space after the "3", right? If not, you'll output the contents of file descriptor 3 in the current shell instead, and that's probably empty. –  sunny256 Aug 30 '09 at 5:59
    
The only problem with this is that if the file is still being written to then the copy you make will be truncated. There's probably no time between when the write stops and the file is closed to do this so that you get a complete file. –  KayEss Jun 3 '13 at 6:14
show 1 more comment

to get the whole file if it is still written to try tail -c +1 -f

from: http://unix.stackexchange.com/questions/25527/how-to-follow-a-la-tail-f-a-binary-file-from-the-beginning

(btw: ln from the fd on /proc doesn't work, just tried that)

share|improve this answer
add comment

There is no portable way to do this under Linux. Best way would probably be to get all activity on the file-system to cease, kill the program that holds the file open, unmount the file system and use a file-system debugger to re-attach it to a directory. If you have the file system exported through NFS, at least some versions of NFS may allow you to read the file data across NFS.

share|improve this answer
    
you may lose the file once you kill the program –  DukeLion Oct 28 '13 at 4:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.