Skip to main content

Ralsina.Me — Roberto Alsina's website

Sometimes I am stupid. Then again, it doesn't matter, because I am lucky!

I am work­ing on chang­ing Bartle­Blog so it can be used from scratch. That may sound odd but be­cause I have been us­ing it since day 2 to post this blog, it has grown very or­gan­i­cal­ly, mean­ing there are things that on­ly work be­cause of the way I used it while de­vel­op­ing it.

So, I cre­at­ed a test user, and cre­at­ed a test blog there, and I am work­ing, and de­cide to do an­oth­er from-scratch test, and...

I delet­ed my pro­duc­tion copy.

Yes. The one that gen­er­ates this blog. So this blog dis­ap­peared. Be­cause I used the wrong ter­mi­nal win­dow.

And I had one-week old back­up­s.

So I felt very very stupid.

Be­cause un­delet­ing in Lin­ux is a joke.

So I was think­ing how to spend a few hours recre­at­ing the last week of post­s, and what­ev­er, when I no­ticed on the taskbar... bartle­blog was still run­ning.

Which means that the DB was still open by a process. Which mean­s...

[ralsina@monty bartleblog]$ ps ax | grep python
17063 pts/1    S     24:33 python bartleblog.py
17161 ?        S      0:04 konqueror [kdeinit] -mimetype text/html http://www.google.com/search?q=python+copy+file&ie=UTF-8&oe=UTF-8
17454 pts/1    D+     0:00 grep python
[ralsina@monty bartleblog]$ su
Password:
[root@monty bartleblog]# cd /proc/17063/fd
[root@monty fd]# ls
0  1  10  11  12  2  3  4  5  6  7  8  9
[root@monty fd]# ls -l
total 0
lrwx------ 1 ralsina users 64 2007-05-13 21:07 0 -> /dev/pts/1
lrwx------ 1 ralsina users 64 2007-05-13 21:07 1 -> /dev/pts/1
lrwx------ 1 ralsina users 64 2007-05-13 21:07 10 -> socket:[159486]
lrwx------ 1 ralsina users 64 2007-05-13 21:07 11 -> socket:[159488]
lrwx------ 1 ralsina users 64 2007-05-13 21:07 12 -> /mnt/centos/home/ralsina/.bartleblog/blog.db (deleted)
lrwx------ 1 ralsina users 64 2007-05-13 21:07 2 -> /dev/pts/1
lr-x------ 1 ralsina users 64 2007-05-13 21:07 3 -> /mnt/centos/home/ralsina/Desktop/proyectos/bartleblog/bartleblog/BartleBlog/ui/bartleblog.py
lr-x------ 1 ralsina users 64 2007-05-13 21:07 4 -> pipe:[159481]
l-wx------ 1 ralsina users 64 2007-05-13 21:07 5 -> pipe:[159481]
lr-x------ 1 ralsina users 64 2007-05-13 21:07 6 -> pipe:[159482]
l-wx------ 1 ralsina users 64 2007-05-13 21:07 7 -> pipe:[159482]
lr-x------ 1 ralsina users 64 2007-05-13 21:07 8 -> pipe:[159485]
l-wx------ 1 ralsina users 64 2007-05-13 21:07 9 -> pipe:[159485]
[root@monty fd]# cp 12 /root/db
[root@monty fd]# ls -l ~/db
-rw-r--r-- 1 root root 3582976 2007-05-13 21:07 /root/db
[root@monty fd]# sqlitebrowser ~/db
[root@monty fd]# cp ~/db /home/ralsina/.bartleblog/blog.db

And I got the data­base back.

If you don't un­der­stand how that worked.... here's the ex­pla­na­tion:

  • On unix, files are re­al­­ly un­linked (re­­moved from di­rec­­to­ries) when no process has them open. Even then, the da­­ta is not delet­ed, but find­­ing it is much hard­er.

  • On /proc/PID you can see the file de­scrip­­tors each process has open.

  • You can ac­­tu­al­­ly copy a file de­scrip­­tor.

So I went and copied the open file. And got it back. And this blog did­n't go away.

So I am luck­y! Stupid. But luck­y!

Trejkaz / 2007-05-16 00:13:

There are various undelete tools too, though it really depends what filesystem you happen to be using since obviously the tool would need to be different for each one.

And then there is the proactive option of using libtrash, which intercepts the calls to delete files and really moves them to the trash. :-)


Contents © 2000-2023 Roberto Alsina