Info: Linux keeps deleted files on disk while any process has them open. /proc/PID/fd/ shows file descriptors with the (deleted) marker for such files. Copy from there to recover.
Examples:
$ sudo lsof +L1 # Find all deleted-but-open files
$ sudo ls -la /proc/$(pgrep nginx)/fd/
$ sudo cp /proc/1234/fd/1 recovered.log
Note: Two steps: identify the FD number, then copy it. Works only while the process runs. Restarting the process = data lost forever.
LinuxTeck.com
linuxteck@ubuntu:~$ sudo ls -la /proc/1234/fd/
total 0
dr-x------ 2 root root 0 Jun 26 15:23 .
dr-xr-xr-x 9 root root 0 Jun 26 15:23 ..
lrwx------ 1 root root 64 Jun 26 15:23 0 -> /dev/null
lrwx------ 1 root root 64 Jun 26 15:23 1 -> /var/log/app.log (deleted)
lrwx------ 1 root root 64 Jun 26 15:23 2 -> /var/log/error.log
lrwx------ 1 root root 64 Jun 26 15:23 3 -> socket:[123456]
linuxteck@ubuntu:~$ sudo cp /proc/1234/fd/1 /home/user/recovered.log
linuxteck@ubuntu:~$
linuxteck@ubuntu:~$
John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.
Leave a Reply