How to Find and Recover Deleted Files on Linux

When working with Linux systems, it's common to encounter situations where deleted files are still held open by applications, taking up valuable storage space. This can be particularly frustrating when you need to free up disk space urgently. In this article, we'll explore how to find and recover deleted files on Linux using the `lsof` command.

Identifying Deleted Files

To start the process of finding deleted files, you'll need to use the `lsof` command in combination with other tools. The `lsof` command stands for 'LiSt Open Files' and is used to list information about open files on a system. To identify deleted files, follow these steps:

1. First, obtain a list of deleted files which are still held open by applications:

```

lsof +L1 /path/to/directory

```

This command will show you the files that have been recently deleted but are still being used by running processes.

2. Next, use the `file` command to verify the file type and check if it's a deleted file:

```

$ file /proc//fd/ # Replace and with the appropriate values

```

For example, from the `lsof` output above:

```

$ echo > /proc/25575/fd/33 # Truncate open file in process

```

Caution!

Applications may not be designed to deal elegantly with this situation and may produce inconsistent or undefined behavior when files that are in use are abruptly truncated in this manner. Therefore, it's essential to exercise caution when using this technique.

Forcefully Truncating Files

If a graceful shutdown does not work, then issue the `kill` command to forcefully stop the process by referencing the PID:

```

kill

```

Alternatively, you can force the system to de-allocate the space consumed by an in-use file by forcing the system to truncate the file via the proc file system.

Recovering Disk Space

Once you've identified and freed up the deleted files, your disk space should be available for use. However, if you're still experiencing issues with disk space utilization, it may be worth checking the filesystem path within the `NAME` field or the device number under `DEVICE` to match the filesystem of interest.

In this article, we've explored how to find and recover deleted files on Linux using the `lsof` command. By following these steps, you should be able to identify deleted files that are still held open by applications and free up valuable storage space on your system. Remember to exercise caution when working with in-use files and always check for potential issues before truncating or deleting them.

Additional Tips

* When you perform a `df`, the storage shows 90+% utilized, however, there is not really that much written to that space.

Find deleted files linux