This page lists various hints about deleted files.
Package upgrade
After a package is upgraded, only services (in /etc/init.d) are restarted. If a program from that package was running during the upgrade, some "traces" will remain after upgrade:
The old version of the program will keep running, as long as it isn't restarted.
- The disk space is still used (even though the files were deleted), until the process is stopped.
The tool checkrestart(1) (from package debian-goodies) can list such programs.
Deleted, but opened file
It is possible to delete a file that is currently opened by another process. The disk space will not be reclaimed immediately... actually, the "file" could keep growing. This behavior is by designed. Actually, this is the reason why the C function call is named unlink(2) rather that delete!
while sleep 1 ; do date ; done > /tmp/Bzzz & tail -f /tmp/Bzzz
This script print the current date every second.
Then, you can switch to another terminal, then delete the file:
rm /tmp/Bzzz
As you can notice, the files keeps growing, since the tail keeps printing new lines!
Now...
How how to recover a deleted opened file ?
If you need to undelete an "opened file", you can use this hint (thanks to Mike Hommey for the hint):
Assuming the running process, which opened the file, has PID=2164:
ls -al /proc/1264/fd total 0 dr-x------. 2 fpiat fpiat 0 2009-06-30 23:42 . dr-xr-xr-x. 7 fpiat fpiat 0 2009-06-30 23:42 .. lrwx------. 1 fpiat fpiat 64 2009-06-30 23:42 0 -> /dev/pts/1 l-wx------. 1 fpiat fpiat 64 2009-06-30 23:42 1 -> /tmp/Bzzz (deleted) lrwx------. 1 fpiat fpiat 64 2009-06-30 23:42 2 -> /dev/pts/1 lrwx------. 1 fpiat fpiat 64 2009-06-30 23:42 255 -> /dev/pts/1
You can retrieve the deleted file's inode number, using lsof(8) (from lsof)
lsof -p 1264 | grep "/tmp/Bzzz" COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bash 1264 john 1w REG 254,4 16200 393313 /tmp/Bzzz (deleted)
You can finally use debugfs(8) to cat/dump/ln that file.