2005-10-07 14:21:28

by Giuseppe Bilotta

[permalink] [raw]
Subject: 'Undeleting' an open file

On Wed, 5 Oct 2005 23:05:34 +0200 (CEST), Bodo Eggert wrote:

> Files are deleted if the last reference is gone. If you play a music file
> and unlink it while it's playing, it won't be deleted untill the player
> closes the file, since an open filehandle is a reference.

BTW, I've always wondered: is there a way to un-unlink such a file?

--
Giuseppe "Oblomov" Bilotta

"I weep for our generation" -- Charlie Brown


2005-10-07 14:25:57

by Bernd Petrovitsch

[permalink] [raw]
Subject: Re: 'Undeleting' an open file

On Fri, 2005-10-07 at 16:14 +0200, Giuseppe Bilotta wrote:
> On Wed, 5 Oct 2005 23:05:34 +0200 (CEST), Bodo Eggert wrote:
>
> > Files are deleted if the last reference is gone. If you play a music file
> > and unlink it while it's playing, it won't be deleted untill the player
> > closes the file, since an open filehandle is a reference.
>
> BTW, I've always wondered: is there a way to un-unlink such a file?

Legally not.
You could turn off the power and do a fsck on a not-journalling
filesystem. But even then it is not sure ...

Bernd
--
Firmix Software GmbH http://www.firmix.at/
mobil: +43 664 4416156 fax: +43 1 7890849-55
Embedded Linux Development and Services

2005-10-07 14:25:58

by Jose Celestino

[permalink] [raw]
Subject: Re: 'Undeleting' an open file

Words by Giuseppe Bilotta [Fri, Oct 07, 2005 at 04:14:27PM +0200]:
> On Wed, 5 Oct 2005 23:05:34 +0200 (CEST), Bodo Eggert wrote:
>
> > Files are deleted if the last reference is gone. If you play a music file
> > and unlink it while it's playing, it won't be deleted untill the player
> > closes the file, since an open filehandle is a reference.
>
> BTW, I've always wondered: is there a way to un-unlink such a file?
>

Well, you can go to /proc/$PID_OF_PROCESSING_OPENING_THE_FILE/fd/

do an ls -la, identify the fd of the file deleted but still open
and do a cp $FD ~/my_deleted_file

Example:

[japc@morgoth:/proc/3743/fd]$ ls -al
total 4
dr-x------ 2 japc japc 0 Oct 7 15:25 .
dr-xr-xr-x 4 japc japc 0 Oct 7 15:23 ..
lr-x------ 1 japc japc 64 Oct 7 15:25 0 -> /dev/null
l-wx------ 1 japc japc 64 Oct 7 15:25 1 -> /home/japc/.xsession-errors
l-wx------ 1 japc japc 64 Oct 7 15:25 2 -> /home/japc/.xsession-errors
lr-x------ 1 japc japc 64 Oct 7 15:25 255 -> /usr/bin/startkde
[japc@morgoth:/proc/3743/fd]$ cp 255 ~/startkde


--
Jose Celestino | http://xpto.org/~japc/files/japc-pgpkey.asc
----------------------------------------------------------------
"Thus the metric system did not really catch on in the States, unless you count
the increasing popularity of the nine-millimeter bullet." -- Dave Barry

2005-10-07 14:30:20

by Ian Campbell

[permalink] [raw]
Subject: Re: 'Undeleting' an open file

On Fri, 2005-10-07 at 16:14 +0200, Giuseppe Bilotta wrote:
> On Wed, 5 Oct 2005 23:05:34 +0200 (CEST), Bodo Eggert wrote:
>
> > Files are deleted if the last reference is gone. If you play a music file
> > and unlink it while it's playing, it won't be deleted untill the player
> > closes the file, since an open filehandle is a reference.
>
> BTW, I've always wondered: is there a way to un-unlink such a file?

Access via /proc/PID/fd/* seems to work:

$ echo "Hello World" > testing
$ exec 10>>testing
$ rm testing
$ ls -l /proc/self/fd/
total 5
lrwx------ 1 icampbell icampbell 64 Oct 7 15:28 0 -> /dev/pts/9
lrwx------ 1 icampbell icampbell 64 Oct 7 15:28 1 -> /dev/pts/9
l-wx------ 1 icampbell icampbell 64 Oct 7 15:28 10
-> /home/icampbell/testing (deleted)
lrwx------ 1 icampbell icampbell 64 Oct 7 15:28 2 -> /dev/pts/9
lr-x------ 1 icampbell icampbell 64 Oct 7 15:28 3 -> /proc/31390/fd/
$ cat /proc/self/fd/10
Hello World
$

Ian.
--
Ian Campbell
Current Noise: Rotting Christ - In Domine Sathana

I may not be totally perfect, but parts of me are excellent.
-- Ashleigh Brilliant

2005-10-07 14:30:42

by Miquel van Smoorenburg

[permalink] [raw]
Subject: Re: 'Undeleting' an open file

In article <[email protected]>,
Giuseppe Bilotta <[email protected]> wrote:
>On Wed, 5 Oct 2005 23:05:34 +0200 (CEST), Bodo Eggert wrote:
>
>> Files are deleted if the last reference is gone. If you play a music file
>> and unlink it while it's playing, it won't be deleted untill the player
>> closes the file, since an open filehandle is a reference.
>
>BTW, I've always wondered: is there a way to un-unlink such a file?

Around 2.4.15 we had the same discussion here - see for example
http://www.ussg.iu.edu/hypermail/linux/kernel/0201.2/0881.html
(but be sure to read the whole thread).

Mike.

2005-10-07 14:44:37

by Bernd Petrovitsch

[permalink] [raw]
Subject: Re: 'Undeleting' an open file

On Fri, 2005-10-07 at 15:30 +0100, Ian Campbell wrote:
> On Fri, 2005-10-07 at 16:14 +0200, Giuseppe Bilotta wrote:
> > On Wed, 5 Oct 2005 23:05:34 +0200 (CEST), Bodo Eggert wrote:
> >
> > > Files are deleted if the last reference is gone. If you play a music file
> > > and unlink it while it's playing, it won't be deleted untill the player
> > > closes the file, since an open filehandle is a reference.
> >
> > BTW, I've always wondered: is there a way to un-unlink such a file?
>
> Access via /proc/PID/fd/* seems to work:
>
> $ echo "Hello World" > testing
> $ exec 10>>testing
> $ rm testing
> $ ls -l /proc/self/fd/
> total 5
> lrwx------ 1 icampbell icampbell 64 Oct 7 15:28 0 -> /dev/pts/9
> lrwx------ 1 icampbell icampbell 64 Oct 7 15:28 1 -> /dev/pts/9
> l-wx------ 1 icampbell icampbell 64 Oct 7 15:28 10
> -> /home/icampbell/testing (deleted)
> lrwx------ 1 icampbell icampbell 64 Oct 7 15:28 2 -> /dev/pts/9
> lr-x------ 1 icampbell icampbell 64 Oct 7 15:28 3 -> /proc/31390/fd/
> $ cat /proc/self/fd/10
> Hello World
> $

Did you try linking it?

Bernd
--
Firmix Software GmbH http://www.firmix.at/
mobil: +43 664 4416156 fax: +43 1 7890849-55
Embedded Linux Development and Services

2005-10-07 15:05:03

by Andreas Schwab

[permalink] [raw]
Subject: Re: 'Undeleting' an open file

Bernd Petrovitsch <[email protected]> writes:

> On Fri, 2005-10-07 at 15:30 +0100, Ian Campbell wrote:
>> Access via /proc/PID/fd/* seems to work:
>>
>> $ echo "Hello World" > testing
>> $ exec 10>>testing
>> $ rm testing
>> $ ls -l /proc/self/fd/
>> total 5
>> lrwx------ 1 icampbell icampbell 64 Oct 7 15:28 0 -> /dev/pts/9
>> lrwx------ 1 icampbell icampbell 64 Oct 7 15:28 1 -> /dev/pts/9
>> l-wx------ 1 icampbell icampbell 64 Oct 7 15:28 10
>> -> /home/icampbell/testing (deleted)
>> lrwx------ 1 icampbell icampbell 64 Oct 7 15:28 2 -> /dev/pts/9
>> lr-x------ 1 icampbell icampbell 64 Oct 7 15:28 3 -> /proc/31390/fd/
>> $ cat /proc/self/fd/10
>> Hello World
>> $
>
> Did you try linking it?

link(2) does not follow symlinks, and there is no flink(2).

Andreas.

--
Andreas Schwab, SuSE Labs, [email protected]
SuSE Linux Products GmbH, Maxfeldstra?e 5, 90409 N?rnberg, Germany
Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."

2005-10-07 15:14:28

by Alex Riesen

[permalink] [raw]
Subject: Re: 'Undeleting' an open file

On 10/7/05, Bernd Petrovitsch <[email protected]> wrote:
> > > > Files are deleted if the last reference is gone. If you play a music file
> > > > and unlink it while it's playing, it won't be deleted untill the player
> > > > closes the file, since an open filehandle is a reference.
> > > BTW, I've always wondered: is there a way to un-unlink such a file?
> > Access via /proc/PID/fd/* seems to work:
> Did you try linking it?
>

ln: creating hard link `testfile2' to `/proc/14282/fd/3': Invalid
cross-device link
Pity :)
"cp" works, btw.

2005-10-07 15:51:52

by Bernd Petrovitsch

[permalink] [raw]
Subject: Re: 'Undeleting' an open file

On Fri, 2005-10-07 at 17:14 +0200, Alex Riesen wrote:
> On 10/7/05, Bernd Petrovitsch <[email protected]> wrote:
> > > > > Files are deleted if the last reference is gone. If you play a music file
> > > > > and unlink it while it's playing, it won't be deleted untill the player
> > > > > closes the file, since an open filehandle is a reference.
> > > > BTW, I've always wondered: is there a way to un-unlink such a file?
> > > Access via /proc/PID/fd/* seems to work:
> > Did you try linking it?
> >
>
> ln: creating hard link `testfile2' to `/proc/14282/fd/3': Invalid
> cross-device link
> Pity :)
> "cp" works, btw.

Yup.
<anal>But then it is not un-unlinking and you get another file.</anal>

Bernd
--
Firmix Software GmbH http://www.firmix.at/
mobil: +43 664 4416156 fax: +43 1 7890849-55
Embedded Linux Development and Services

2005-10-07 17:32:01

by Giuseppe Bilotta

[permalink] [raw]
Subject: Re: 'Undeleting' an open file

On Fri, 7 Oct 2005 14:30:37 +0000 (UTC), Miquel van Smoorenburg wrote:

> In article <[email protected]>,
> Giuseppe Bilotta <[email protected]> wrote:
>>On Wed, 5 Oct 2005 23:05:34 +0200 (CEST), Bodo Eggert wrote:
>>
>>> Files are deleted if the last reference is gone. If you play a music file
>>> and unlink it while it's playing, it won't be deleted untill the player
>>> closes the file, since an open filehandle is a reference.
>>
>>BTW, I've always wondered: is there a way to un-unlink such a file?
>
> Around 2.4.15 we had the same discussion here - see for example
> http://www.ussg.iu.edu/hypermail/linux/kernel/0201.2/0881.html
> (but be sure to read the whole thread).

A very interesting read, thank you for the link.

--
Giuseppe "Oblomov" Bilotta

Axiom I of the Giuseppe Bilotta
theory of IT:
Anything is better than MS