$ cat important_file > /dev/null &
[1] 9711
$ rm important_file
$ killall -STOP cat
[1]+ Stopped cat important_file > /tmp/p
$ ls -l /proc/`pidof cat`/fd/
total 0
lrwx------ 1 vi vi 64 May 13 20:32 0 -> /dev/pts/29
l-wx------ 1 vi vi 64 May 13 20:32 1 -> /tmp/p
lrwx------ 1 vi vi 64 May 13 20:32 2 -> /dev/pts/29
lr-x------ 1 vi vi 64 May 13 20:32 3 -> /home/vi/important_file (deleted)
Come recuperarlo important_file
?
Ho provato qualcosa del genere
injcode -m dup2 -ofd=3 -ofilename=/tmp/recovered_file -oflags=O_CREAT $PID_OF_CAT
ma non fa nulla.
readlink /proc/13381/fd/3
-> "/ home / vi / important_file (cancellato)" e/home/vi/important_file\ \(deleted\)
ovviamente non esiste.