Dan Hatton wrote:
Thanks Mark. I followed the instructions linked above, but I've got a feeling all they did was save a snapshot of the file as it was when I followed the instructions, whereas what I want is a snapshot of its state just before the process that's going to write it exits. But the above URL did give me the clue that the symlink in /proc exists.
Presumably, now you have access to the file via /proc, you could "tail -f" it so that you have another process holding it open.
Then you can copy it after the first process finishes, but before killing the tail. Or just tail -f /proc/blah/blah > ~/copy-of-file.txt
.. and when the original file has gone you'll have a copy anyway in copy-of-file.txt
What I've done for now is written a little perl script that opens the symlink in /proc for reading, then enters an endless loop. That should preserve my data until I can open them in a text editor and copy and paste them somewhere safe, right?
Ought to work, although I'd like to test it before committing to it :-)