Re: Shell script removed but still executing

From: Chris F.A. Johnson (c.f.a.johnson_at_rogers.com)
Date: 07/11/03


Date: 11 Jul 2003 16:10:57 GMT

On Fri, 11 Jul 2003 at 15:36 GMT, Stephane CHAZELAS wrote:
> Franco wrote:
>> Somebody accidentaly removed an important shell script that hasn't backuped.
>> BUT the script is still running!!!
>>
>> That is, if I write "ps -ef" I still see "./name.sh" in execution even if
>> the file has been removed.
>>
>> Is there any way to get the script source back?
>
> On a Linux system, example of restoration:
>
> ~$ bash a &
> [2] 2124
> ~$ rm a
> ~$ ls -l /proc/2124/fd
> total 0
> lrwx------ 1 chazelas users 64 2003-07-11 17:24 0 -> /dev/pts/5
> lrwx------ 1 chazelas users 64 2003-07-11 17:24 1 -> /dev/pts/5
> lrwx------ 1 chazelas users 64 2003-07-11 17:24 2 -> /dev/pts/5
> lr-x------ 1 chazelas users 64 2003-07-11 17:24 255 -> /home/chazelas/a (deleted)
> lrwx------ 1 chazelas users 64 2003-07-11 17:24 3 -> /dev/pts/5
> ~$ ls -Li /proc/2124/fd/255
> 29729 /proc/2124/fd/255
> ~$ sudo debugfs /dev/hda6
> Password:
> debugfs 1.32 (09-Nov-2002)
> debugfs: dump <29729> /tmp/a.restore
> ~$ ls -l /tmp/a.restore
> -rw-r--r-- 1 root root 172 2003-07-11 17:25 /tmp/a.restore

    Or just:

pid=2124 ## adjust to taste
cat /proc/$pid/fd/255 > $pid.sh

    FreeBSD also uses a /proc psuedo filesystem, but it doesn't store
    the script.

-- 
    Chris F.A. Johnson                        http://cfaj.freeshell.org
    ===================================================================
    My code (if any) in this post is copyright 2003, Chris F.A. Johnson
    and may be copied under the terms of the GNU General Public License