Linux – Recover deleted file that is currently being written to

data-recoverydeleted-filesfilesystemslinuxopen files

I started downloading a big file and accidently deleted it a while ago. I know how to get its current contents by cping /proc/<pid>/fd/<fd> but since the download is still in progress it'll be incomplete at the time I copy it someplace else.

Can I somehow salvage the file right at the moment the download finishes but before the downloader closes the file and I lose it for good?

Best Answer

Using tail in follow mode should allow you to do what you want.

tail -n +0 -f /proc/<pid>/fd/<fd> > abc.deleted

I just did a quick test and it seems to work here. You did not mention whether your file was a binary file or not. My main concern is that it may not copy from the start of file but the -n +0 argument should do that even for binary files.

The tail command may not terminate at the end of the download so you will need to terminate it yourself.

Related Question