Date: Sat, 28 Nov 2015 17:57:46 +0800 From: Julian Elischer <julian@freebsd.org> To: "Mikhail T." <mi+thun@aldan.algebra.com>, freebsd-fs@freebsd.org Subject: Re: Recovering an unlink-ed, but still opened file Message-ID: <56597A9A.5020404@freebsd.org> In-Reply-To: <5658E498.9070700@aldan.algebra.com> References: <5658E498.9070700@aldan.algebra.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 28/11/2015 7:17 AM, Mikhail T. wrote:
> A deleted file, that's still opened by a process is "there" on the
> filesystem.
>
> Is there any way -- with an existing command-line utility or a new
> program using an existing API -- to give the still-valid inode a name
> again? Wouldn't that be a wonderful feature to have? Thanks!
well, I've done this in the distant past:
(there may be easier ways involving /proc if you have it mounted etc.)
touch /tmp/anyfile
gdb cp
break main
run /tmp/anyfile /tmp/saved
(program breaks)
break open
{step until you get the open of anyfile}
place a breakpoint just after the open.
continue
{program stops with file opened)
take note of file descriptor.
kgdb /boot/kernel/kernel /dev/mem
{find procedd descriptors of both processes.. (the one you have with
the file you want, and the 'cp' above.
follow links to file descriptors
swap vnode pointers in the descriptors you want.
set a breakpoint at 'close' in the 'cp'
continue the 'cp'
swap pointers back within kernel.
continue cp so that it exits.
go read contents of file
>
> -mi
>
> _______________________________________________
> freebsd-fs@freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-fs
> To unsubscribe, send any mail to "freebsd-fs-unsubscribe@freebsd.org"
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?56597A9A.5020404>