Jose Celestino wrote:
*This message was transferred with a trial version of CommuniGate(r) Pro*
Words by Doug Wyatt [Fri, Aug 15, 2008 at 05:47:55AM -0500]:
Russell Miller wrote:
On Fri, Aug 15, 2008 at 12:30 AM, Russell Miller <duskglow@xxxxxxxxx
<mailto:duskglow@xxxxxxxxx>> wrote:
On Fri, Aug 15, 2008 at 12:17 AM, Doug Wyatt <dwyatt@xxxxxxxxxxxxx
<mailto:dwyatt@xxxxxxxxxxxxx>> wrote:
Here's the situation - I have video file, currently open
in Mplayer, which I accidentally deleted from its directory.
So, the storage and inode still exist as long as I don't
close the Mplayer.
Does anyone know of a way, using available commands or via
system calls in a program, to reestablish a link from a
directory to the inode?
You might try going into debugfs, finding the inode, and seeing if
you can tell it it's not deleted anymore. It's not actually deleted
until all the references are closed, so I think it might be possible
(I don't know the internal details of what happens when a file is
deleted but not closed so I may be wrong).
Oh hey. Look what I found.
http://dag.wieers.com/blog/undeleting-an-open-file-by-inode
Still risky but at least you won't be flying blind.
--Russell
Excellent!
Debugfs was exactly what I was looking for. I already had the
inode number from lsof. Going into debugfs and using 'ln' and
'set_inode_field' (for incrementing the link count) took care
of my problem.
I did download the source for 'fdlink', mentioned in a comment
on <dag.wieers.com>, and looked it over. But I decided, for
this situation, debugfs was less likely to cause a problem.
There's a much easier way. Well, you don't really relink the inode but
copy the original file instead:
1. locate the open (deleted) file you want from the opening pid on /proc/$PID/fd/*
2. cp /proc/$PID/fd/$FD somewhere
I think I read, somewhere, that in doing that I could end up
with garbage bytes at the end of the last block in the copy,
and would need to use the size from the original inode to
trim the copied file. Don't know if that's fact or not.
Also, by re-linking you preserve the mtime w/o hassling with
touch.
Re-linking the inode seems more elegant and satisfying after
performing a klutzy move like deleting the wrong file.
--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
