# Recover or Reclaim space of deleted open file#

## Recover File#

When you delete an open file, you are just removing the link to its inode. The inode is still open and data blocks are still not made available for writing until the process closes the file.

Using lsof(8), you can find the file descriptor under the path /proc/PID/fd/ (PID is the process identifier) and copy the file descriptor.

As an example, let’s create a file

$cd /tmp$ echo "Hello World!" > hello.txt


Hold the file open, run less to display the contents and press Ctrl-Z to suspend it.

$less hello.txt [1]+ Stopped less hello.txt  Remove hello.txt file $ rm hello.txt
$ls -l hello.txt ls: cannot access 'hello.txt': No such file or directory  The hello.txt file is removed. Now, let’s bring the file back. Get the file descriptor, use lsof and grep hello / delete. $ lsof | grep hello
less       2066      hwidjaja  4r  REG   8,32  13   61985 /tmp/hello.txt (deleted)
$lsof | grep delete less 2066 hwidjaja 4r REG 8,32 13 61985 /tmp/hello.txt (deleted)  From the output, 2066 is the PID of the process and 4r is the file descriptor (r means that it’s a regular file). Copy the file descriptor to restore. $ cp /proc/2066/fd/4 restored_hello.txt


Verify