0

I started a program on a directory but accidentally removed it, and the program inside. The program generates a couple of output files. The program is still running. I wonder if I create the same directory the program will still create the output files there. Is that possible?

Rui F Ribeiro
  • 56,709
  • 26
  • 150
  • 232
Andreu Heisenberg
  • 69
  • I changed some of the words: They are directories (of file-names), files can have more than one name, in more than one directory (so folder is a poor metaphor). Files are removed from a directory, this only causes them to be deleted if there are no more directory entries for the file and no processes have the file open. – ctrl-alt-delor Nov 20 '18 at 10:13

1 Answers1

1

Once the entries for the files have been removed from the fiesystem, they cannot be recreated. If you create a new directory with the name of the old directory, it's just that: a new directory. The files don't magically appear again.

Unix (including linux) filesystems work by having inodes that contain all the information about a file, except its name. In directories entries are made with a name and an inode number, this is the only coupling of the name with its contents. It's possible to create another link to the file using ln, with a completely different filename.

When a file is deleted, its reference count is reduced. Once that reaches zero, the file is actually deleted (the space it takes up is returned to the free block pool, and the inode is cleared). However, as long as a process still has the file open, the reference count doesn't reach zero, the file is still in existence.

Linux makes the files opened by a process available through the /proc/ pseudo filesystem. If you know the process ID (pid) of the process, look in /proc/pid/fd/ for a list of files opened. E.g. for an apache process, here's an abbreviated list:

$ sudo ls -l /proc/32704/fd
total 0
lr-x------ 1 root root 64 Nov 20 02:39 0 -> /dev/null
l-wx------ 1 root root 64 Nov 20 02:39 1 -> /dev/null
lr-x------ 1 root root 64 Nov 20 02:39 10 -> /dev/random
lrwx------ 1 root root 64 Nov 20 02:39 11 -> /tmp/.ZendSem.6DE1g1 (deleted)
lrwx------ 1 root root 64 Nov 20 02:39 12 -> anon_inode:[eventpoll]
l-wx------ 1 root root 64 Nov 20 02:39 2 -> /var/log/apache2/error.log

Note the line with (deleted) appended to it. Apache uses that for a temporary file that can't be accessed by others: it creates and opens the file, and then unlinks (removed) it. However it can still use it, and apache's child processes can also use it as they inherit open files.

In your case you should also be able to find the deleted files. Via the /proc entries you can copy the "deleted" files to somewhere safe as long as the process is running:

sudo cp /proc/pid/fd/x $HOME/somewheresafe/filename
wurtel
  • 16,115
  • thanks for your answer, now i understand how this process work. Unfortunately my program terminated and when it was going to write the output files it suffered a segmentation fault. I do not think there is anything to do about it, the files would not have been written, I believe. – Andreu Heisenberg Nov 21 '18 at 11:27