Recovering Deleted Files With lsof

Jun 01, 2009, 20:04 (1 Talkback[s])
(Other stories by Juliet Kemp)

"A file in Linux is a pointer to an inode, which contains the file data (permissions, owner and where its actual content lives on the disk). Deleting the file removes the link, but not the inode itself -- if another process has it open, the inode isn't released for writing until that process is done with it."

Complete Story

Related Stories:

• Disk Encryption With TrueCrypt(May 21, 2009)
• Controlling Ubuntu's and Fedora's Upstart (the init replacement)(May 14, 2009)
• Protecting Your Root Password(May 12, 2009)
• Rescuing a Lost Root Password(May 06, 2009)
• Ubuntu and Fedora Replace init with Upstart(May 05, 2009)
• lsof, sockets and trojans(Apr 30, 2009)
• E-mail Encryption With GPG and Thunderbird(Apr 21, 2009)