Tim Otten <[EMAIL PROTECTED]> writes: > The other day, I did something really stupid. I started a download with > BitTorrent, and, half-way through, deleted the file it was downloading. > > The file still existed because the torrent client had it open. I could use > 'lsof' to get an inode number -- but I needed some way to get access to > that node without having an entry in the file tree. > > I looked in a bunch of obvious places -- /proc/nnn/fd, man pages and > source for mknod, ln, and libc's link(). But it seems that all the work > relating to actual inodes is done in kernel space -- where I have no > experience.
/proc/PID/fd seems to work just fine; see transcript below. > Is it possible to access the file using a utility or small C program? > Would you have to write code for the kernel? [EMAIL PROTECTED]:~ > echo This is a test. > t.txt [EMAIL PROTECTED]:~ > tail -f t.txt > /dev/null & # keep file open [1] 1334 [EMAIL PROTECTED]:~ > rm t.txt [EMAIL PROTECTED]:~ > cat t.txt cat: t.txt: No such file or directory [EMAIL PROTECTED]:~ > cd /proc/1334/fd [EMAIL PROTECTED]:/proc/1334/fd > ls -l total 0 lrwx------ 1 martin users 64 Feb 15 19:45 0 -> /dev/pts/2 l-wx------ 1 martin users 64 Feb 15 19:45 1 -> /dev/null lrwx------ 1 martin users 64 Feb 15 19:45 2 -> /dev/pts/2 lr-x------ 1 martin users 64 Feb 15 19:45 3 -> /home/martin/t.txt (deleted) [EMAIL PROTECTED]:/proc/1334/fd > cat 3 This is a test. [EMAIL PROTECTED]:/proc/1334/fd > cat 3 > ~/recovered [EMAIL PROTECTED]:/proc/1334/fd > cd [EMAIL PROTECTED]:~ > kill 1334 [1]+ Terminated tail -f t.txt >/dev/null [EMAIL PROTECTED]:~ > cat recovered This is a test. Martin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
