Sunday, January 15, 2012

Recovering a (in use) removed file in GNU/Linux

    This has never happened to me, before. I downloaded a video to my $HOME/Downloads directory and I was watching it in VLC-Player. For some reason, I paused it and started managing files in my $HOME directory. Later, I removed all files from my $HOME/Downloads directory.
    Now, here is the game. I removed the video along with the unwanted files which was still in use by VLC. I didn't realized it that time. I got back to vlc and resumed the playback. After few moments, my jaw was dropped. I didn't really know how did it worked. So, I started working to get that video back. I knew it was still in the memory, but, how to get it back!

    I thought, there would be a 'save' option in the File menu of vlc player. Unfortunately, it wasn't there. So, I had to start digging in. Few days ago, to monitor the 'files in use,' I'd learned the lsof (list open files) command. And it extremely useful to find the file descriptor of that file.

  Here are the steps I followed, to recover that file:

1. Finding the file descriptor:
I wanted the PID number of the process  by which the file was opened. Simply, I got it using ps and grep.

 $ps -e | grep vlc

2. Now, I'd the PID of vlc. And I wanted the FD number of that file.

$lsof -np PID-of-vlc-player

3. Now, simply I wanted to copy this file from that file descriptor which was in /proc file system.

$cp /proc/PID/fd/FDNUM $HOME

    I had my video now. Actually, I could download that video in this time, but, recovering that file was kind of a challenge. That taught me a lesson, too. :-)