1

I accidentally deleted the dir, /path/to/dir, and all its contents from an application.

However, I still have a terminal window open, still cd-ed in /path/to/dir!

Q: Is there any way to recursively recover /path/to/dir?

Note that lsof gives me this:

$ lsof | egrep '/path/to'
bash       3113              hs  cwd       DIR              252,0     4096 42207179 /path/to
bash       3487              hs  cwd       DIR              252,0        0 42207253 /path/to/dir (deleted)

Further, if I do this...

$ ls /proc/3487/fd/
0  1  2  255

$ cd /tmp
$ dd if=/proc/3487/fd/255 of=recovered.dir bs=1M

... the dd command just sits there doing nothing, with recovered.dir's size not growing. I was assuming here that the process 3487 has the directory /path/to/dir open at the file-descriptor 255, and so, if I dd or cat it, I would be able to recover the entire tree /path/to/dir.

There are plenty of articles on the web on how to use lsof to recover deleted regular files, but none for recovering deleted directories.

Would greatly appreciate a quick response!!

Gilles 'SO- stop being evil'
  • 829,060
Harry
  • 812
  • 1
    Stop writing to the disk immediately. You may have a chance to recover individual files. The files are now fully deleted (as in: the space they occupy is marked as free), but their data may still be lying around. It won't be lying around any more if you overwrite it. Each file is likely to be an independent recovery effort. Better reach for your backups. – Gilles 'SO- stop being evil' Oct 19 '14 at 13:05

1 Answers1

4

Unfortunately you cannot do what you seek.

While the directory may be held open, the files that reside within the directory are not part of the directory itself. The directory simply stores the file names. In addition to this, with the files having been deleted, the directory has already been modified to remove those files.

In short, unless each individual file is held open, they cannot be recovered in this manner.

phemmer
  • 71,831