Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite
1

I'm trying the preview release of Flash Player "Square" for Linux and noticed that video files are now being deleted from the /tmp/ folder.

Yet the files are still in use (I can see them with lsof):

chromium- 8948 user   25u   REG                8,5  2599793    229908 /tmp/FlashXXStJt3K (deleted)

Is there a way to prevent flash from deleting them or a way to recover them?

share|improve this question
as an alternative you might be able to create an SELinux, AppArmor, or other advanced security policy to prevent stuff from deleting stuff. – xenoterracide♦ Oct 15 '10 at 0:29

1 Answer

up vote 3 down vote accepted

I've never tried this before, but...

There is a link to the file in /proc/8948/fd/. You can catenate the file as root (it's only readable as root), and pipe it to a new file. Whether the file is intact, I've not verified.

share|improve this answer
Yes, even if the file appears red with ls (implying the symlink is broken) I was able to cat and pipe to a new file as root. Thanks. – Jhonny Oct 14 '10 at 19:00
I think you can even hardlink it out of there (using the ln command) – pjc50 Feb 15 '11 at 16:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.