linux-ext4 - Re: undelete still opened file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20081017143311.52d50a23.taeuber@bbaw.de>
Date:	Fri, 17 Oct 2008 14:33:11 +0200
From:	Lars Täuber <taeuber@...w.de>
To:	"Manish Katiyar" <mkatiyar@...il.com>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: undelete still opened file

Hi Manish,

"Manish Katiyar" <mkatiyar@...il.com> schrieb:
> > I thought about something in connection with /proc/####/fd/# .
> > Is there any chance to get the file back to normal?
> 
> To some extent yes......

yes I know I could do this:

cat /proc/####/fd/32 > /dir/to/new/file.ext

but then all changes made by the process afterwards are not in the copy.

> You can try the /proc/****/fd/** approach . It has worked for me in
> past......but that was for a running binary.

Of course there is a process still running and works with a file discriptor to the deleted file.

Onother question:
Is the space of the file on the underlying block device already marked as free? Or does this happen after all processes have closed all file descriptors pointing to the file?

I really want to undo the deletion. (get a link/name connected to the root inode of the file again)
Is there a way to do this?

Thanks
Lars
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html