This question is related to How to recover deleted files? but it is slightly different in nature.
Suppose I have a file named ~/something
open in a text editor. Further suppose that I open a terminal and run the following command while the file is still open in the text editor:
rm ~/something
This will delete the file. Now suppose that I changed my mind and wanted to get the file back. The file is still open in the text editor, so it hasn't been removed from the disk or filesystem yet.
Is there any way to recover it?
Best Answer
I don't know whether there are any text editors which keep the file opened while you are editing it. Normally (i.e. in Emacs), the file is read into a buffer in RAM and then the file is closed. You edit only in RAM. When you save the buffer, the file is opened, written, and closed again. You can use
ps auxw | grep your_editor
to find the PID of your editor, thenlsof -p your_PID
to see the files that are still open.On the other hand, if the file is still in the buffer of your editor, you can just save it.
But that was not your question, so let's pretend you are using
cat
as your editor, and the file is really still open:You can use
lsof -n
to see all opened files andgrep
to search for your filename.In the second column you can see the PID of your
cat
command. You can change into the corresponding directory in the /proc filesystem, and into thefd
(file descriptor) subdirectory:Now you can just copy the "file"
1
to another file:And see, it's there: