From owner-freebsd-fs@freebsd.org Sat Nov 28 09:58:16 2015 Return-Path: Delivered-To: freebsd-fs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6D39FA3ADE6 for ; Sat, 28 Nov 2015 09:58:16 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 3ECC91A6B for ; Sat, 28 Nov 2015 09:58:15 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from Julian-MBP3.local (ppp121-45-225-88.lns20.per1.internode.on.net [121.45.225.88]) (authenticated bits=0) by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id tAS9vqVr084475 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Sat, 28 Nov 2015 01:57:55 -0800 (PST) (envelope-from julian@freebsd.org) Subject: Re: Recovering an unlink-ed, but still opened file To: "Mikhail T." , freebsd-fs@freebsd.org References: <5658E498.9070700@aldan.algebra.com> From: Julian Elischer Message-ID: <56597A9A.5020404@freebsd.org> Date: Sat, 28 Nov 2015 17:57:46 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 In-Reply-To: <5658E498.9070700@aldan.algebra.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Nov 2015 09:58:16 -0000 On 28/11/2015 7:17 AM, Mikhail T. wrote: > A deleted file, that's still opened by a process is "there" on the > filesystem. > > Is there any way -- with an existing command-line utility or a new > program using an existing API -- to give the still-valid inode a name > again? Wouldn't that be a wonderful feature to have? Thanks! well, I've done this in the distant past: (there may be easier ways involving /proc if you have it mounted etc.) touch /tmp/anyfile gdb cp break main run /tmp/anyfile /tmp/saved (program breaks) break open {step until you get the open of anyfile} place a breakpoint just after the open. continue {program stops with file opened) take note of file descriptor. kgdb /boot/kernel/kernel /dev/mem {find procedd descriptors of both processes.. (the one you have with the file you want, and the 'cp' above. follow links to file descriptors swap vnode pointers in the descriptors you want. set a breakpoint at 'close' in the 'cp' continue the 'cp' swap pointers back within kernel. continue cp so that it exits. go read contents of file > > -mi > > _______________________________________________ > freebsd-fs@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-fs > To unsubscribe, send any mail to "freebsd-fs-unsubscribe@freebsd.org" >