Macos – How to recover a deleted file that is still open

data-recoverymacosprocess

How can one restore a file that has been deleted but is still open by a process?

The blog post "Restoring files from /proc" explains how to do this on Linux:

  1. Use lsof (e.g., lsof -c name) to find all files currently open for the given process (whose name starts with name). From the output, you learn the process's pid and the file descriptor (fd) of the file you are looking for.
  2. Use cp /proc/<pid>/fd/<fd> /tmp/restored-file` to make a copy.

The first step works one-to-one on OS X, too. However, step 2 seems more complicated. Is there a similar feature on OS X?

(I tried /dev/fd but in my case, it did not contain the PID/FD of my process/file.)

Best Answer

I couldn't find an OSX equivalent, but answering anyway since this may be urgent. If the file is really important to recover and you have to shut the system down, remount the filesystem the file was on read-only and image the partition with a tool such as CloneZilla, - this will preserve your ability to use various recovery tools in case the space the file was using gets reallocated to another file.

Depending on what type of file you need to recover, PhotoRec might be able to find it. Also, the free version of Disk Drill may be useful, and depending on what filesystem is in use, there's a small chance TestDisk may be of help (doesn't fully support Mac filesystems, even though it runs on OSX).

Related Question