> A neat trick here is that you can effectively still access the file (even restore it) if a process has the file open, through the /proc filesystem. A techniq

> A neat trick here is that you can effectively still access the file (even restore it) if a process has the file open, through the /proc filesystem. A technique used in the most extreme unix system recovery story I've ever read, by Al Viro: http://yarchive.net/comp/linux/extreme_system_recovery.html http://yarchive.net/comp/linux/extreme_system_recovery.html Wherein: * system libraries are recovered from init still having them mapped/opened, as you describe * basic system utilities like 'ln' are recreated from their syscalls and writing the assembly * ELF binaries are recreated by crafting their headers manually