5 ms·
this works on pretty much all unixes and recently saved my team's ass after a 3am finger fumble that unlinked a very important 500g file.
by elq 18y ago
this works on pretty much all unixes and recently saved my team's ass after a 3am finger fumble that unlinked a very important 500g file.
- kragen 18y agoLast time I used them, none of the following Unixes had a /proc filesystem: FreeBSD, NetBSD, IRIX, AIX, Ultrix, SunOS 4, MacOS X, NeXTStep. The only Unixes I do know of that have it are Solaris (SunOS 5), Linux, and Plan 9, which isn't really Unix.
- elq 18y agoThe root of this "trick" is that rm does not delete the file it reduces its inode link count, until the inode link count goes to 0, the file is still on disk. look up fsdb and friends.
- kragen 18y agoEven after the inode link count is 0, if a process still has the file open, it still remains on disk; that's the root of this trick. However, that is not sufficient; you also need a way to get access to the file so you can copy the data out of it before the process closes it. That is the interesting part of this trick — a way to use the /proc filesystem to get at the file. cp /proc/322/fd/3 savedfile is a lot easier than fiddling around with fsdb on a mounted filesystem.
- elq 18y agocopying the file from /proc creates a copy. fsdb allows you to map a name to an inode (er.. inode to a name). this is quite handy if the file is being written to. and fsdb is frequently available where proc is not.
- cperciva 18y agoFreeBSD has a procfs, but it isn't mounted by default -- mostly due to its unofficial name (rootmefs).