topic Re: deleted file in Operating System - Linux

deleted file

Piotr Kirklewski — Wed, 17 Nov 2010 02:53:20 GMT

root@pxe001bri:~# lsof |grep tftpboot
in.tftpd 5281 root cwd DIR 251,0 0 2223873 /tftpboot (deleted)

Hi there
I'm trying to recover the above file.
root@pxe001bri:~# cp /proc/5281/fd/4 myfile.saved
cp: cannot open `/proc/5281/fd/4' for reading: No such device or address

root@pxe001bri:~# ls -la /proc/5281/fd/4
lrwx------ 1 root root 64 2010-11-16 21:34 /proc/5281/fd/4 -> socket:[28748]

Anyone knows how to recover from that ?

Re: deleted file

Dennis Handly — Wed, 17 Nov 2010 08:06:33 GMT

What version of Linux are you running?

Why would you want to copy a socket?

Re: deleted file

Piotr Kirklewski — Wed, 17 Nov 2010 13:43:54 GMT

Debian - so what do I do ?

Re: deleted file

Steven Schweda — Wed, 17 Nov 2010 13:57:59 GMT

> Debian - so what do I do ?

Why ask in an HP-UX forum?

Re: deleted file

Matti_Kurkela — Wed, 17 Nov 2010 14:06:28 GMT

> # lsof |grep tftpboot
> in.tftpd 5281 root cwd DIR 251,0 0 2223873 /tftpboot (deleted)

Note that the line says "cwd" and "DIR". /tftpboot is not a file, but a directory. It is the current working directory of process 5281. Looks like this is a TFTP server process, started by inetd.

> # ls -la /proc/5281/fd/4
> lrwx------ 1 root root 64 2010-11-16 21:34 /proc/5281/fd/4 -> socket:[28748]

This indicates /proc/5281/fd/4 is a socket, not a regular file. It probably represents a network connection to a TFTP client, or perhaps a local connection to the syslog service. I'd say copying it would not be meaningful.

When the /tftpboot directory was deleted, one of two things may have happened: either the directory was empty, or the deletion command was given with the recursive option and it deleted all the files and sub-directories in the directory.

Rebuilding the directory itself is simple:

mkdir /tftpboot

But because there are no files currently open in the /tftpboot directory, any files that might have been there are now gone.

Look for backups if you want to recover them.

(I think a TFTP server would only hold regular files open while a TFTP GET or PUT operation is ongoing; it would have no reason to hold any files open beyond that.)

MK