Ubuntu Linux Recover Deleted Files With lsof
1)
Create a file
$vim myfile1.txt
2)
Open that file with program "tail"
$tail -f myfile1.txt
3)
Delete that file
$rm myfile1.txt
4)
Find PID of process which opened "myfile1.txt"
$sudo lsof | grep myfile1.txt
OR
#ps -aux | grep tail
5)
Recover that file
$cp /proc/xxx/fd/4 myfile1.txt
* xxx is the PID of process which opened "myfile1.txt", this case it is "tail".
آی-ویدئو