Linux recovery steps for deleting files by lsof command

There are many usages of the lsof command in Linux system. Recovery of accidentally deleted files is one of the usages, especially the recovery of log files. The following small series will introduce you to the method of using Linux to use lsof command to recover accidentally deleted files.

Prerequisites: After deleting the file, the process is still accessible with, therefore, more suitable for the log file type for recovery.

When a Linux computer is compromised, it is common for log files to be deleted to mask the attacker's trail. Administrative errors can also cause accidental deletion of important files, such as accidentally deleting the active transaction log of the database while cleaning up old logs. Sometimes these files can be recovered by lsof.

When a process opens a file, as long as the process keeps the file open, even if it is deleted, it still exists on disk. This means that the process does not know that the file has been deleted, it can still read and write to the file descriptor provided to it when the file is opened. Except for this process, this file is invisible because its corresponding directory index node has been deleted.

In the /proc directory, it contains various files that reflect the kernel and the process tree. The /proc directory mounts an area that is mapped in memory, so these files and directories do not exist on the disk, so when we read and write to these files, they are actually getting from memory. Related Information. Most of the information related to lsof is stored in a directory named after the PID of the process, that is, /proc/1234 contains information about the process with PID 1234. There are various files in each process directory that allow the application to simply understand the process's memory space, file descriptor list, symbolic links to files on disk, and other system information. The lsof program uses this information and other information about the internal state of the kernel to produce its output. So lsof can display information such as the file descriptor of the process and the associated file name. That is, we can find information about the file by accessing the file descriptor of the process. When a file in the system is accidentally deleted, as long as there are still processes in the system that are accessing the file, then we can restore the contents of the file from the /proc directory via lsof.

If the /var/log/messages file is deleted due to a misoperation, then the method to restore the /var/log/messages file is as follows: First use lsof to see if there is a process open currently /The var/logmessages file is as follows:

# lsof