Where do open file handles go when they die

filesystemsopen files

What happens to the files that are deleted while they have a file handle open to them?

I have been wondering this ever since I figured out I could delete a video file while it was playing in MPlayer and it would still play through to the end. Where is it pulling the data from? Is it still coming from the hard drive? Did it get copied to RAM once I deleted the file?

If it's still on the hard drive, what happens if I fill up the file system while the program is running reading from what is essentially unallocated space? If it's buffered in RAM, what happens if I flush the buffers?

What happens if the file was on an NFS share–is it stored on the server? (Isn't that a security risk–DoS by tons of open remote file handles?)

Doing an lsof -n |grep '(deleted)' sometimes yields interesting results; if I'm upgrading packages that swap out shared library files, then running programs that had been using those libraries will still be able to use them as if nothing changed.

Bonus question: Is there some way to get the data back from the dead in this situation?

Best Answer

The inodes still persist on disk, although no more hard links to the inodes exist. They will be deleted when the file descriptor is closed. Until then, the file can be modified as normal, barring operations that require a filename/hard link.

debugfs and similar tools can be used to recover the contents of the inodes.

Related Question