hi all,
i've accidentally deleted a still running executable and i've thought it could be restored simply copying /proc/$PID/exe, but it's not because it's a (broken) symlink to the deleted file...
with lsof i can still see the inode of the file, so my questions are: is it possible to hardlink the inode? how?
if not, is there any other way to recover the executable?
thank you
recover deleted (but running) executable
Message
unfortunately i had to reboot, so i finally had to rebuild the deleted executable...
but for the sake to try and learning something new (at least for me), i've replicated the situation:
filesystem is ext4, do i need CONFIG_EXT4_DEBUG enabled?
but for the sake to try and learning something new (at least for me), i've replicated the situation:
Code: Select all
$ ls -li test
28454299 -rwxr-xr-x 1 skunk skunk 5613016 Aug 2 18:31 test
$ ./test &
$ rm test
$ ps ax|grep test
18866 pts/8 Sl+ 0:08 ./test
lsof -p18866|grep /home/skunk/test
test 18866 skunk txt REG 8,3 5613016 28454299 /home/skunk/test (deleted)
# debugfs -w /dev/sda3
debugfs 1.42.10 (18-May-2014)
debugfs: logdump -i <28454299>
Inode 28454299 is at group 3473, block 113771148, offset 3328
Journal starts at block 24724, transaction 12843711
No magic number at block 27541: end of journal.
# mount|grep debugfs
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)