On Fri, 2008-02-08 at 10:53 +0000, Dan Hatton wrote:
Dear All,
I foolishly rm'd a file that a lengthy process still has open for writing (although it has yet to write any data.) That is, the output of lsof -p 26733 includes
gnuplot 26733 dan 4w REG 253,0 0 6802530 /home/dan/Natural_Sciences/mushy/twentyfirstplot.dat (deleted)
It would be really valuable to be able to save the data that process 26733 eventually writes to this file. Any ideas, please?
Hi Dan,
First you need to note the starting inode number from lsof (6802530), then you can re-create the missing directory entry using debugfs (as root). After which you can ritually slap yourself :)
This page explains how to drive debugfs to create a directory link.
http://tldp.org/HOWTO/Ext2fs-Undeletion-11.html
Phil.