20

How can one restore a file that has been deleted but is still open by a process?

The blog post "Restoring files from /proc" explains how to do this on Linux:

  1. Use lsof (e.g., lsof -c name) to find all files currently open for the given process (whose name starts with name). From the output, you learn the process's pid and the file descriptor (fd) of the file you are looking for.
  2. Use cp /proc/<pid>/fd/<fd> /tmp/restored-file` to make a copy.

The first step works one-to-one on OS X, too. However, step 2 seems more complicated. Is there a similar feature on OS X?

(I tried /dev/fd but in my case, it did not contain the PID/FD of my process/file.)

Glorfindel
  • 4,099
Hbf
  • 301

1 Answers1

3

I couldn't find an OSX equivalent, but answering anyway since this may be urgent. If the file is really important to recover and you have to shut the system down, remount the filesystem the file was on read-only and image the partition with a tool such as CloneZilla, - this will preserve your ability to use various recovery tools in case the space the file was using gets reallocated to another file.

Depending on what type of file you need to recover, PhotoRec might be able to find it. Also, the free version of Disk Drill may be useful, and depending on what filesystem is in use, there's a small chance TestDisk may be of help (doesn't fully support Mac filesystems, even though it runs on OSX).

Stephanie
  • 2,328
  • 1
    Testdisk: http://www.cgsecurity.org/wiki/TestDisk; Photorec: http://www.cgsecurity.org/wiki/PhotoRec - Both of these are better than most other file recovery tools I've used. Photorec won't necessarily recover metadata, but the data's there. This is probably too late, but you could also run one of these off a flash drive before rebooting if you think the risk of something else overwriting the sectors is low. – Nick Jun 21 '12 at 17:57
  • Thanks, @Stephanie, very kind of you, for sharing the approach and the tools. I was asking the question out of interest, to learn more about OS X, so fortunately no urgency involved (but I appreciate your timely reply!). – Hbf Jun 22 '12 at 16:14