linux-ext4 - Re: undelete still opened file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ea11fea30810170333n4ba9a681l7b64862834899aac@mail.gmail.com>
Date:	Fri, 17 Oct 2008 16:03:11 +0530
From:	"Manish Katiyar" <mkatiyar@...il.com>
To:	"Lars Täuber" <taeuber@...w.de>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: undelete still opened file

On Fri, Oct 17, 2008 at 3:38 PM, Lars Täuber <taeuber@...w.de> wrote:
> Hi there!
>
> If this should be the wrong mailing list please excuse me but I didn't find any better suiting.
> I just subscribed after unsuccessfully searching on the net for an answer to my question.
>
> Is it possible to undelete an accidentally deleted file that is still opened by a process?
> As far as I know the file is not really deleted as long there is a file descriptor connected to the file.
> I thought about something in connection with /proc/####/fd/# .
> Is there any chance to get the file back to normal?

To some extent yes......

>
> - Linux 2.6.[12]x
> - ext3 or nfs (should be independent of fs, wouldn't it?)

It is tightly coupled with the filesystem. So depending on your
filesystem you may or may not get it.

LOGFS (or any log structured file system) : They generally have
snapshots or some kind of file versioning. So you can retreive it from
there.

ext2 : After deletion ext2 doesn't zero the block pointers. So it is
possible to get it from there using debugfs.

ext3 : Search google for "Carlo wood + ext3grep"

ext4 : I don't know of any method ...

You can try the /proc/****/fd/** approach . It has worked for me in
past......but that was for a running binary. I am not sure about
shellscript kind of thing. There are some other tools too to recover ,
unfortunately I don't remember the name but google should be good
enough.

Thanks -
Manish

>
>
> Thanks and best regards.
> Lars
>
>
> PS: Sorry for my english.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html