Sometimes I am stupid. Then again, it doesn't matter, because I am lucky!

I am working on changing BartleBlog so it can be used from scratch. That may sound odd but because I have been using it since day 2 to post this blog, it has grown very organically, meaning there are things that only work because of the way I used it while developing it.

So, I created a test user, and created a test blog there, and I am working, and decide to do another from-scratch test, and...

I deleted my production copy.

Yes. The one that generates this blog. So this blog disappeared. Because I used the wrong terminal window.

And I had one-week old backups.

So I felt very very stupid.

Because undeleting in Linux is a joke.

So I was thinking how to spend a few hours recreating the last week of posts, and whatever, when I noticed on the taskbar... bartleblog was still running.

Which means that the DB was still open by a process. Which means...

[[email protected] bartleblog]$ ps ax | grep python
17063 pts/1    S     24:33 python bartleblog.py
17161 ?        S      0:04 konqueror [kdeinit] -mimetype text/html http://www.google.com/search?q=python+copy+file&ie=UTF-8&oe=UTF-8
17454 pts/1    D+     0:00 grep python
[[email protected] bartleblog]$ su
Password:
[[email protected] bartleblog]# cd /proc/17063/fd
[[email protected] fd]# ls
0  1  10  11  12  2  3  4  5  6  7  8  9
[[email protected] fd]# ls -l
total 0
lrwx------ 1 ralsina users 64 2007-05-13 21:07 0 -> /dev/pts/1
lrwx------ 1 ralsina users 64 2007-05-13 21:07 1 -> /dev/pts/1
lrwx------ 1 ralsina users 64 2007-05-13 21:07 10 -> socket:[159486]
lrwx------ 1 ralsina users 64 2007-05-13 21:07 11 -> socket:[159488]
lrwx------ 1 ralsina users 64 2007-05-13 21:07 12 -> /mnt/centos/home/ralsina/.bartleblog/blog.db (deleted)
lrwx------ 1 ralsina users 64 2007-05-13 21:07 2 -> /dev/pts/1
lr-x------ 1 ralsina users 64 2007-05-13 21:07 3 -> /mnt/centos/home/ralsina/Desktop/proyectos/bartleblog/bartleblog/BartleBlog/ui/bartleblog.py
lr-x------ 1 ralsina users 64 2007-05-13 21:07 4 -> pipe:[159481]
l-wx------ 1 ralsina users 64 2007-05-13 21:07 5 -> pipe:[159481]
lr-x------ 1 ralsina users 64 2007-05-13 21:07 6 -> pipe:[159482]
l-wx------ 1 ralsina users 64 2007-05-13 21:07 7 -> pipe:[159482]
lr-x------ 1 ralsina users 64 2007-05-13 21:07 8 -> pipe:[159485]
l-wx------ 1 ralsina users 64 2007-05-13 21:07 9 -> pipe:[159485]
[[email protected] fd]# cp 12 /root/db
[[email protected] fd]# ls -l ~/db
-rw-r--r-- 1 root root 3582976 2007-05-13 21:07 /root/db
[[email protected] fd]# sqlitebrowser ~/db
[[email protected] fd]# cp ~/db /home/ralsina/.bartleblog/blog.db

And I got the database back.

If you don't understand how that worked.... here's the explanation:

  • On unix, files are really unlinked (removed from directories) when no process has them open. Even then, the data is not deleted, but finding it is much harder.
  • On /proc/PID you can see the file descriptors each process has open.
  • You can actually copy a file descriptor.

So I went and copied the open file. And got it back. And this blog didn't go away.

So I am lucky! Stupid. But lucky!

Comments

Comments powered by Disqus