Can I create a link to an inode?

[Aaron Konstam]

On Fri, 2008-08-15 at 13:42 -0500, Doug Wyatt wrote:
> Jose Celestino wrote:
> > *This message was transferred with a trial version of CommuniGate(r) Pro*
> > Words by Doug Wyatt [Fri, Aug 15, 2008 at 05:47:55AM -0500]:
> >>
> >> Russell Miller wrote:
> >>>
> >>> On Fri, Aug 15, 2008 at 12:30 AM, Russell Miller <duskglow at gmail.com  
> >>> <mailto:duskglow at gmail.com>> wrote:
> >>>
> >>>
> >>>
> >>>     On Fri, Aug 15, 2008 at 12:17 AM, Doug Wyatt <dwyatt at sunflower.com
> >>>     <mailto:dwyatt at sunflower.com>> wrote:
> >>>
> >>>         Here's the situation - I have video file, currently open
> >>>         in Mplayer, which I accidentally deleted from its directory.
> >>>
> >>>         So, the storage and inode still exist as long as I don't
> >>>         close the Mplayer.
> >>>
> >>>         Does anyone know of a way, using available commands or via
> >>>         system calls in a program, to reestablish a link from a
> >>>         directory to the inode?
> >>>
> >>>
> >>>
> >>>     You might try going into debugfs, finding the inode, and seeing if
> >>>     you can tell it it's not deleted anymore.  It's not actually deleted
> >>>     until all the references are closed, so I think it might be possible
> >>>     (I don't know the internal details of what happens when a file is
> >>>     deleted but not closed so I may be wrong).
> >>>
> >>>
> >>> Oh hey.  Look what I found.
> >>>
> >>> http://dag.wieers.com/blog/undeleting-an-open-file-by-inode
> >>>
> >>> Still risky but at least you won't be flying blind.
> >>>
> >>> --Russell
> >>>
> >> Excellent!
> >>
> >> Debugfs was exactly what I was looking for.  I already had the
> >> inode number from lsof.  Going into debugfs and using 'ln' and
> >> 'set_inode_field' (for incrementing the link count) took care
> >> of my problem.
> >>
> >> I did download the source for 'fdlink', mentioned in a comment
> >> on <dag.wieers.com>, and looked it over.  But I decided, for
> >> this situation, debugfs was less likely to cause a problem.
> >>
> > 
> > There's a much easier way. Well, you don't really relink the inode but
> > copy the original file instead:
> > 
> > 1. locate the open (deleted) file you want from the opening pid on /proc/$PID/fd/*
> > 2. cp /proc/$PID/fd/$FD somewhere
> > 
> 
> I think I read, somewhere, that in doing that I could end up
> with garbage bytes at the end of the last block in the copy,
> and would need to use the size from the original inode to
> trim the copied file.  Don't know if that's fact or not.
> 
> Also, by re-linking you preserve the mtime w/o hassling with
> touch.
> 
> Re-linking the inode seems more elegant and satisfying after
> performing a klutzy move like deleting the wrong file.
> 
I have a strong feeling that all this only works on ext2 files. For
those the mc program will undelete. But the journal of the ext3 system
will cause this to end up with garbage. 
--
=======================================================================
One person's error is another person's data.
=======================================================================
Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam at sbcglobal.net