Linux如何恢复已打开并删除的文件

已打开文件，如果从磁盘上删除了这个文件，磁盘inode数据已经改变，难以找回。
但是文件没有关闭，进程没有退出之前，可以从/proc里找到文件fd, 并且读出其中的内容

linux-d4xo:~/temp/test # ls /proc/53712/fd/ -l
total 0
lrwx------ 1 root root 64 Sep 19 02:39 0 -> /dev/pts/1
lrwx------ 1 root root 64 Sep 19 02:39 1 -> /dev/pts/1
lrwx------ 1 root root 64 Sep 19 02:39 2 -> /dev/pts/1
lrwx------ 1 root root 64 Sep 19 02:39 3 -> /mnt/lv1/aaaa
linux-d4xo:~/temp/test # rm /mnt/lv1/aaaa
linux-d4xo:~/temp/test # lsof /mnt/lv1
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
a.out   53712 root    3u   REG  254,0       14   14 /mnt/lv1/aaaa (deleted)
linux-d4xo:~/temp/test # ls /proc/53712/fd/ -l
total 0
lrwx------ 1 root root 64 Sep 19 02:39 0 -> /dev/pts/1
lrwx------ 1 root root 64 Sep 19 02:39 1 -> /dev/pts/1
lrwx------ 1 root root 64 Sep 19 02:39 2 -> /dev/pts/1
lrwx------ 1 root root 64 Sep 19 02:39 3 -> /mnt/lv1/aaaa (deleted)
linux-d4xo:~/temp/test # cat /mnt/lv1/aaaa
cat: /mnt/lv1/aaaa: No such file or directory
linux-d4xo:~/temp/test # cat /proc/53712/fd/3
hello test rm

linux-d4xo:~/temp/test # dd if=/proc/53712/fd/3 of=/cccc
0+1 records in
0+1 records out
14 bytes copied, 0.000238676 s, 58.7 kB/s
linux-d4xo:~/temp/test # cat /cccc
hello test rm

转自https://blog.csdn.net/sinat_38723234/article/details/101025897#comments_17906042