Recover or Reclaim space of deleted open file
Recover or Reclaim space of deleted open file#
When you delete an open file, you are just removing the link to its inode. The inode is still open and data blocks are still not made available for writing until the process closes the file.
Using lsof(8), you can find the file descriptor under the path
/proc/PID/fd/ (PID is the process identifier) and copy the file descriptor.
As an example, let’s create a file
$ cd /tmp $ echo "Hello World!" > hello.txt
Hold the file open, run
less to display the contents and press
Ctrl-Z to suspend it.
$ less hello.txt + Stopped less hello.txt
$ rm hello.txt $ ls -l hello.txt ls: cannot access 'hello.txt': No such file or directory
hello.txt file is removed.
Now, let’s bring the file back. Get the file descriptor, use
lsof and grep
$ lsof | grep hello less 2066 hwidjaja 4r REG 8,32 13 61985 /tmp/hello.txt (deleted) $ lsof | grep delete less 2066 hwidjaja 4r REG 8,32 13 61985 /tmp/hello.txt (deleted)
From the output,
2066 is the PID of the process and
4r is the file descriptor (
r means that it’s a regular file).
Copy the file descriptor to restore.
$ cp /proc/2066/fd/4 restored_hello.txt
$ cat restored_hello.txt Hello World!
If you can’t kill the process and want to reclaim storage used by the deleted file, you can truncate it.
$ > /proc/2066/fd/4