file recover

sh

一个终端（记为A）：

# [07/06 19:16:15] xenon@ribosome ~ $
touch delete-me
# [07/06 19:16:22] xenon@ribosome ~ $
vim delete-me
写进去一行字，作为内容。

另一个终端（记为B）打开文件：

# [07/06 19:16:05] xenon@ribosome ~ $
python
Python 2.7.5 (default, Jun 10 2013, 12:07:26)
[GCC 4.7.3] on linux2
Type “help”, “copyright”, “credits” or “license” for more information.
>>> fp = open(‘delete-me’)
>>> fp

>>>

在A里删掉文件：

# [07/06 19:16:34] xenon@ribosome ~ $
rm delete-me
rm：是否删除普通文件 “delete-me”？y

找到刚才的Python进程：

# [07/06 19:16:50] xenon@ribosome ~ $
ps -Af | grep python
xenon 3285 3114 0 17:53 ? 00:00:01 /usr/bin/python2.7
/usr/bin/terminator
xenon 4844 3114 0 19:16 ? 00:00:00 /usr/bin/python2.7
/usr/bin/terminator
xenon 4933 4866 0 19:16 pts/1 00:00:00 /usr/bin/python2.7
xenon 4934 3114 1 19:16 ? 00:00:00 /usr/bin/python2.7
/usr/bin/terminator
xenon 5070 4956 0 19:16 pts/2 00:00:00 grep –color=auto python

是4933，然后：

# [07/06 19:17:03] xenon@ribosome /proc/4933/fd $
ll /proc/4933/fd
总用量 0
dr-x—— 2 xenon xenon 0 7月 6 19:16 ./
dr-xr-xr-x 8 xenon xenon 0 7月 6 19:16 ../
lrwx—— 1 xenon xenon 64 7月 6 19:17 0 -> /dev/pts/1
lrwx—— 1 xenon xenon 64 7月 6 19:17 1 -> /dev/pts/1
lrwx—— 1 xenon xenon 64 7月 6 19:16 2 -> /dev/pts/1
lr-x—— 1 xenon xenon 64 7月 6 19:17 3 -> /home/xenon/delete-me (deleted)
# [07/06 19:17:04] xenon@ribosome /proc/4933/fd $
cat /proc/4933/fd/3
This is data to be recovered~