proc - Linux file deleted recovery -
is there way create file in linux link specific inode? take scenario: there file in course of writing (a log maybe) , specific file deleted but link in dir /proc still pointing @ it. in case need not bare copy of hard link can have future modifications , last modification before process close , system delete it.
if have inode number there way achieve goal?
since there no syscall involves inode, because concept of extx fs , not practice make stove pipe make chain of responsability (as m.e.l. suggests), there no answer question because @ vfs level handle files path , names , not other internal representations.
but achieve goal track last modification can use continous monitoring , duplication tail:
tail -c+1 -f --pid=pid /proc/pid/fd/fd > /path/to/the/copy
where pid pid of process have deleted file still opened , fd file descriptor number. -f tail open , hold file display further modification, -c+1 start "tail" first byte , --pid=pid tail informed exit when pid exit.
Comments
Post a Comment