Quote:
Originally Posted by
reminisce
Note: The directory was deleted with other use not root user.
That is irrelevant - dead is dead and deleted is deleted.
Quote:
Originally Posted by
reminisce
In one of the youtube link ,the admin provided some steps to get back the lost files.
As first step, below command needs to be executed :
ps -aux | grep <filename>
As an output, I could find the file and process id .
That
may help as long as the process is running: when a file is deleted the system routine
unlink() is used, which deletes the inode (and thus every possibility to access the files data). As long as at least one process still has this file opened, though, the
unlink() is postponed, so the process still can access the file even though "from outside" the file already ceases to exist.
This means,
if you can somehow get "inside" the process in question and
if you can bring the process to write the file (or, at least, its inode information)
then you can use this to restore the file, otherwise it is lost.
You
might have luck with trying
TestDisk as long as you haven't done anything further on that filesystem. My suggestion is to unmount it as soon as possible (preferably: NOW!) because the longer it is in use the bigger the chance that data which are still there (but unaccessible right now) will be overwritten (=definitely and ultimately lost forever).
I hope this helps.
bakunin