用 lsof 恢复 误删除文件实验: 先模拟一个进程: [tiger@root:/home/tiger]$ echo "hello deletede" >> test.txt [tiger@root:/home/tiger]$ cat >> test.txt 模拟恢复实验： [tiger@root:/home/tiger]$ lsof | grep test.txt cat 2982671 tiger 1w REG 253,2 15 2673 /home/tiger/test.txt [tiger@root:/home/tiger]$ rm test.txt rm: remove regular file `test.txt'? y [tiger@root:/home/tiger]$ lsof | grep test.txt cat 2982671 tiger 1w REG 253,2 15 2673 /home/tiger/test.txt (deleted) [tiger@root:/home/tiger]$ cd /proc/2982671/fd/1 -bash: cd: /proc/2982671/fd/1: Not a directory [tiger@root:/home/tiger]$ cd /proc/2982671/fd [tiger@root:/proc/2982671/fd]$ [tiger@root:/proc/2982671/fd]$ ll total 0 lrwx------ 1 tiger tiger 64 Jan 27 02:12 0 -> /dev/pts/1 l-wx------ 1 tiger tiger 64 Jan 27 02:12 1 -> /home/tiger/test.txt (deleted) lrwx------ 1 tiger tiger 64 Jan 27 02:12 2 -> /dev/pts/1 [tiger@root:/proc/2982671/fd]$ cd 1 -bash: cd: 1: Not a directory [tiger@root:/proc/2982671/fd]$ cat 1 hello deletede [tiger@root:/proc/2982671/fd]$ cp 1 /home/tiger/test.txt [tiger@root:/proc/2982671/fd]$ ls -lrt | grep test.txt l-wx------ 1 tiger tiger 64 Jan 27 02:12 1 -> /home/tiger/test.txt (deleted) [tiger@root:/proc/2982671/fd]$ cat 1 hello deletede [tiger@root:/proc/2982671/fd]$ cat 1 > /home/tiger/test.txt [tiger@root:/proc/2982671/fd]$ ls -lrt | grep test.txt l-wx------ 1 tiger tiger 64 Jan 27 02:12 1 -> /home/tiger/test.txt (deleted) [tiger@root:/proc/2982671/fd]$ ll /home/tiger total 32 -rwxr-x--- 1 tiger tiger 147 Jan 4 09:45 def.py -rw-r----- 1 tiger tiger 42 Jan 18 06:19 hello.txt -rwxr-x--- 1 tiger tiger 142 Jan 4 03:43 if.py -rwxr-x--- 1 tiger tiger 346 Jan 20 07:40 open.py -rwxr-x--- 1 tiger tiger 179 Jan 20 08:00 os.py -rwxr-x--- 1 tiger tiger 112 Jan 20 07:41 sort.py -rw-r----- 1 tiger tiger 15 Jan 27 02:15 test.txt -rwxr-x--- 1 tiger tiger 410 Jan 26 06:27 try.py [tiger@root:/proc/2982671/fd]$ cat test.txt cat: test.txt: No such file or directory [tiger@root:/proc/2982671/fd]$ cat test.txt cat: test.txt: No such file or directory [tiger@root:/proc/2982671/fd]$ cat /home/tiger/test.txt hello deletede