cancel
Showing results for 
Search instead for 
Did you mean: 

deleted file

Piotr Kirklewski
Super Advisor

deleted file

root@pxe001bri:~# lsof |grep tftpboot
in.tftpd 5281 root cwd DIR 251,0 0 2223873 /tftpboot (deleted)

Hi there
I'm trying to recover the above file.
root@pxe001bri:~# cp /proc/5281/fd/4 myfile.saved
cp: cannot open `/proc/5281/fd/4' for reading: No such device or address

root@pxe001bri:~# ls -la /proc/5281/fd/4
lrwx------ 1 root root 64 2010-11-16 21:34 /proc/5281/fd/4 -> socket:[28748]

Anyone knows how to recover from that ?
Jesus is the King
4 REPLIES
Dennis Handly
Acclaimed Contributor

Re: deleted file

What version of Linux are you running?

Why would you want to copy a socket?
Piotr Kirklewski
Super Advisor

Re: deleted file

Debian - so what do I do ?
Jesus is the King
Steven Schweda
Honored Contributor

Re: deleted file

> Debian - so what do I do ?

Why ask in an HP-UX forum?
Matti_Kurkela
Honored Contributor

Re: deleted file

> # lsof |grep tftpboot
> in.tftpd 5281 root cwd DIR 251,0 0 2223873 /tftpboot (deleted)

Note that the line says "cwd" and "DIR". /tftpboot is not a file, but a directory. It is the current working directory of process 5281. Looks like this is a TFTP server process, started by inetd.

> # ls -la /proc/5281/fd/4
> lrwx------ 1 root root 64 2010-11-16 21:34 /proc/5281/fd/4 -> socket:[28748]

This indicates /proc/5281/fd/4 is a socket, not a regular file. It probably represents a network connection to a TFTP client, or perhaps a local connection to the syslog service. I'd say copying it would not be meaningful.

When the /tftpboot directory was deleted, one of two things may have happened: either the directory was empty, or the deletion command was given with the recursive option and it deleted all the files and sub-directories in the directory.

Rebuilding the directory itself is simple:

mkdir /tftpboot

But because there are no files currently open in the /tftpboot directory, any files that might have been there are now gone.

Look for backups if you want to recover them.

(I think a TFTP server would only hold regular files open while a TFTP GET or PUT operation is ongoing; it would have no reason to hold any files open beyond that.)

MK
MK