36
Recover deleted files via procfs
Run these commands:
# The disk image was deleted by accident
$ ls /srv/disk1.raw
ls: cannot access '/srv/disk1.raw': No such file or directory
# Luckily, PID 1257 still has a reference
$ readlink /proc/1257/fd/* | grep disk
/srv/disk1.raw (deleted)
# Make sure the process does not alter it
# while we read it back
$ kill -STOP 1257
# Read it back
$ cat /proc/1257/fd/18 > /srv/disk1.raw
Deleting a file on Linux occurs in two stages.
First, the directory entry is removed, and then the inode and the data are deleted once the last reference to the inode is gone.
If a file is currently being used by a process and is deleted, there is a way to recover it.
Using Linux’s procfs, the file can be recovered as follows:
Get in touch
sigma star gmbh
Eduard-Bodem-Gasse 6, 1st floor
6020 Innsbruck | Austria
