Friday, 2 September 2011

Deep Magic - recover a file

We have hopefully managed to recover a file (or two) today from an existing process in which the files live in /tmp/, but if the process goes on too long, get deleted by the system
Find relevant Process ID
  >ps aux or top
  >pstree -p 

Work out files which have handles but are deleted
  >lsof -p 
  bwa     22039 srpipe    4r   REG      104,7  424718660  67171651 /tmp/iFCyWKyDjR/1.sai (deleted)
  bwa     22039 srpipe    5r   REG      104,7  401682372  67171652 /tmp/iFCyWKyDjR/2.sai (deleted)

Rebuild files
  >mkdir /tmp/iFCyWKyDjR
  >cat /proc/22039/fd/4 > /tmp/iFCyWKyDjR/1.sai
  >cat /proc/22039/fd/5 > /tmp/iFCyWKyDjR/2.sai

  >ls -lh /tmp/iFCyWKyDjR
  total 789M
  -rw-rw-r-- 1 srpipe solexa 406M 2011-09-02 09:30 1.sai
  -rw-rw-r-- 1 srpipe solexa 384M 2011-09-02 09:30 2.sai