How to recover a deleted file that is still open?

How can one restore a file that has been deleted but is still open by a process?

The blog post "Restoring files from /proc" explains how to do this on Linux:

Use lsof (e.g., lsof -c name) to find all files currently open for the given process (whose name starts with name). From the output, you learn the process's pid and the file descriptor (fd) of the file you are looking for.
Use cp /proc/<pid>/fd/<fd> /tmp/restored-file` to make a copy.

The first step works one-to-one on OS X, too. However, step 2 seems more complicated. Is there a similar feature on OS X?

(I tried /dev/fd but in my case, it did not contain the PID/FD of my process/file.)

Hbf

Posted 2012-06-20T09:57:50.490

Reputation: 301

Answers

I couldn't find an OSX equivalent, but answering anyway since this may be urgent. If the file is really important to recover and you have to shut the system down, remount the filesystem the file was on read-only and image the partition with a tool such as CloneZilla, - this will preserve your ability to use various recovery tools in case the space the file was using gets reallocated to another file.

Depending on what type of file you need to recover, PhotoRec might be able to find it. Also, the free version of Disk Drill may be useful, and depending on what filesystem is in use, there's a small chance TestDisk may be of help (doesn't fully support Mac filesystems, even though it runs on OSX).

Stephanie

Posted 2012-06-20T09:57:50.490

Reputation: 1 778

Testdisk: http://www.cgsecurity.org/wiki/TestDisk; Photorec: http://www.cgsecurity.org/wiki/PhotoRec - Both of these are better than most other file recovery tools I've used. Photorec won't necessarily recover metadata, but the data's there. This is probably too late, but you could also run one of these off a flash drive before rebooting if you think the risk of something else overwriting the sectors is low.

– Nick – 2012-06-21T17:57:23.407

Thanks, @Stephanie, very kind of you, for sharing the approach and the tools. I was asking the question out of interest, to learn more about OS X, so fortunately no urgency involved (but I appreciate your timely reply!). – Hbf – 2012-06-22T16:14:59.323