Wednesday, 20 May 2015 00:00

How to recover the deleted but still opened file in Linux

Rate this item
(0 votes)

If a file was accidentally deleted but it is still opened in any program

(for example is being played in a media player), it can easily be recovered from

file descriptor of the /proc file system

Let's suppose we have accidentally deleted the 1.mp3 file which is still being played in mplayer.

We look for PID of mplayer

   ps -auxwww|grep mplayer
   gosha  17314  3.2  0.4  38680  8908 pts/3  SL+ 00:45 0:00 mplayer 1.mp3

We go to the /proc directory with the process parameters of 17314:

   cd /proc/17314 

The open file descriptors are listed in the fd directory (/proc/17314/fd).

   cd fd
   ls -al

In the output we see the descriptor #4 flagged as deleted.

   lr-x------ 1 gosha gosha 64 2009-02-27 00:48 4 -> /home/gosha/1.mp3 (deleted)

We copy it and get the recovered file:

   cp 4 /home/gosha/1.mp3

Last modified on Wednesday, 20 May 2015 13:21
Data Recovery Expert

Viktor S., Ph.D. (Electrical/Computer Engineering), was hired by DataRecoup, the international data recovery corporation, in 2012. Promoted to Engineering Senior Manager in 2010 and then to his current position, as C.I.O. of DataRecoup, in 2014. Responsible for the management of critical, high-priority RAID data recovery cases and the application of his expert, comprehensive knowledge in database data retrieval. He is also responsible for planning and implementing SEO/SEM and other internet-based marketing strategies. Currently, Viktor S., Ph.D., is focusing on the further development and expansion of DataRecoup’s major internet marketing campaign for their already successful proprietary software application “Data Recovery for Windows” (an application which he developed).

Leave a comment

Make sure you enter the (*) required information where indicated. HTML code is not allowed.