Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying the preview release of Flash Player "Square" for Linux and noticed that video files are now being deleted from the /tmp/ folder.

Yet the files are still in use (I can see them with lsof):

chromium- 8948 user   25u   REG                8,5  2599793    229908 /tmp/FlashXXStJt3K (deleted)

Is there a way to prevent flash from deleting them or a way to recover them?

share|improve this question
    
as an alternative you might be able to create an SELinux, AppArmor, or other advanced security policy to prevent stuff from deleting stuff. – xenoterracide Oct 15 '10 at 0:29
up vote 3 down vote accepted

I've never tried this before, but...

There is a link to the file in /proc/8948/fd/. You can catenate the file as root (it's only readable as root), and pipe it to a new file. Whether the file is intact, I've not verified.

share|improve this answer
    
Yes, even if the file appears red with ls (implying the symlink is broken) I was able to cat and pipe to a new file as root. Thanks. – Jhonny Oct 14 '10 at 19:00
    
I think you can even hardlink it out of there (using the ln command) – pjc50 Feb 15 '11 at 16:08
    
linking in current versions of linux is impossible - you can only read/write it. – undefine Feb 1 '15 at 12:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.