Custom Search

Wednesday, April 20, 2016

Ubuntu Linux Recover Deleted Files With lsof

1)
Create a file
$vim myfile1.txt

2)
Open that file with program "tail"
$tail -f myfile1.txt

3)
Delete that file
$rm myfile1.txt

4)
Find PID of process which opened "myfile1.txt"
$sudo lsof | grep myfile1.txt
OR
#ps -aux | grep tail

5)
Recover that file
$cp /proc/xxx/fd/4 myfile1.txt

* xxx is the PID of process which opened "myfile1.txt", this case it is "tail".



No comments:

Post a Comment