用 lsof 恢复 误删除文件实验:
先模拟一个进程:
[tiger@root:/home/tiger]$ echo "hello deletede" >> test.txt
[tiger@root:/home/tiger]$ cat >> test.txt
模拟恢复实验:
[tiger@root:/home/tiger]$ lsof | grep test.txt
cat 2982671 tiger 1w REG 253,2 15 2673 /home/tiger/test.txt
[tiger@root:/home/tiger]$ rm test.txt
rm: remove regular file `test.txt'? y
[tiger@root:/home/tiger]$ lsof | grep test.txt
cat 2982671 tiger 1w REG 253,2 15 2673 /home/tiger/test.txt (deleted)
[tiger@root:/home/tiger]$ cd /proc/2982671/fd/1
-bash: cd: /proc/2982671/fd/1: Not a directory
[tiger@root:/home/tiger]$ cd /proc/2982671/fd
[tiger@root:/proc/2982671/fd]$
[tiger@root:/proc/2982671/fd]$ ll
total 0
lrwx------ 1 tiger tiger 64 Jan 27 02:12 0 -> /dev/pts/1
l-wx------ 1 tiger tiger 64 Jan 27 02:12 1 -> /home/tiger/test.txt (deleted)
lrwx------ 1 tiger tiger 64 Jan 27 02:12 2 -> /dev/pts/1
[tiger@root:/proc/2982671/fd]$ cd 1
-bash: cd: 1: Not a directory
[tiger@root:/proc/2982671/fd]$ cat 1
hello deletede
[tiger@root:/proc/2982671/fd]$ cp 1 /home/tiger/test.txt
[tiger@root:/proc/2982671/fd]$ ls -lrt | grep test.txt
l-wx------ 1 tiger tiger 64 Jan 27 02:12 1 -> /home/tiger/test.txt (deleted)
[tiger@root:/proc/2982671/fd]$ cat 1
hello deletede
[tiger@root:/proc/2982671/fd]$ cat 1 > /home/tiger/test.txt
[tiger@root:/proc/2982671/fd]$ ls -lrt | grep test.txt
l-wx------ 1 tiger tiger 64 Jan 27 02:12 1 -> /home/tiger/test.txt (deleted)
[tiger@root:/proc/2982671/fd]$ ll /home/tiger
total 32
-rwxr-x--- 1 tiger tiger 147 Jan 4 09:45 def.py
-rw-r----- 1 tiger tiger 42 Jan 18 06:19 hello.txt
-rwxr-x--- 1 tiger tiger 142 Jan 4 03:43 if.py
-rwxr-x--- 1 tiger tiger 346 Jan 20 07:40 open.py
-rwxr-x--- 1 tiger tiger 179 Jan 20 08:00 os.py
-rwxr-x--- 1 tiger tiger 112 Jan 20 07:41 sort.py
-rw-r----- 1 tiger tiger 15 Jan 27 02:15 test.txt
-rwxr-x--- 1 tiger tiger 410 Jan 26 06:27 try.py
[tiger@root:/proc/2982671/fd]$ cat test.txt
cat: test.txt: No such file or directory
[tiger@root:/proc/2982671/fd]$ cat test.txt
cat: test.txt: No such file or directory
[tiger@root:/proc/2982671/fd]$ cat /home/tiger/test.txt
hello deletede