Can I create a link to an inode?

[Konstantin Svist]

Doug Wyatt wrote:
>
> Jose Celestino wrote:
>> *This message was transferred with a trial version of CommuniGate(r) 
>> Pro*
>> Words by Doug Wyatt [Fri, Aug 15, 2008 at 05:47:55AM -0500]:
>>>
>>> Russell Miller wrote:
>>>>
>>>> On Fri, Aug 15, 2008 at 12:30 AM, Russell Miller 
>>>> <duskglow at gmail.com  <mailto:duskglow at gmail.com>> wrote:
>>>>
>>>>
>>>>
>>>>     On Fri, Aug 15, 2008 at 12:17 AM, Doug Wyatt <dwyatt at sunflower.com
>>>>     <mailto:dwyatt at sunflower.com>> wrote:
>>>>
>>>>         Here's the situation - I have video file, currently open
>>>>         in Mplayer, which I accidentally deleted from its directory.
>>>>
>>>>         So, the storage and inode still exist as long as I don't
>>>>         close the Mplayer.
>>>>
>>>>         Does anyone know of a way, using available commands or via
>>>>         system calls in a program, to reestablish a link from a
>>>>         directory to the inode?
>>>>
>>>>
>>>>
>>>>     You might try going into debugfs, finding the inode, and seeing if
>>>>     you can tell it it's not deleted anymore.  It's not actually 
>>>> deleted
>>>>     until all the references are closed, so I think it might be 
>>>> possible
>>>>     (I don't know the internal details of what happens when a file is
>>>>     deleted but not closed so I may be wrong).
>>>>
>>>>
>>>> Oh hey.  Look what I found.
>>>>
>>>> http://dag.wieers.com/blog/undeleting-an-open-file-by-inode
>>>>
>>>> Still risky but at least you won't be flying blind.
>>>>
>>>> --Russell
>>>>
>>> Excellent!
>>>
>>> Debugfs was exactly what I was looking for.  I already had the
>>> inode number from lsof.  Going into debugfs and using 'ln' and
>>> 'set_inode_field' (for incrementing the link count) took care
>>> of my problem.
>>>
>>> I did download the source for 'fdlink', mentioned in a comment
>>> on <dag.wieers.com>, and looked it over.  But I decided, for
>>> this situation, debugfs was less likely to cause a problem.
>>>
>>
>> There's a much easier way. Well, you don't really relink the inode but
>> copy the original file instead:
>>
>> 1. locate the open (deleted) file you want from the opening pid on 
>> /proc/$PID/fd/*
>> 2. cp /proc/$PID/fd/$FD somewhere
>>
>
> I think I read, somewhere, that in doing that I could end up
> with garbage bytes at the end of the last block in the copy,
> and would need to use the size from the original inode to
> trim the copied file.  Don't know if that's fact or not.
>
> Also, by re-linking you preserve the mtime w/o hassling with
> touch.
>
> Re-linking the inode seems more elegant and satisfying after
> performing a klutzy move like deleting the wrong file.
>

I just tried to replicate your problem and cp -L worked perfectly, no 
garbage bytes or anything.

Re-linking the inode is inherently dangerous, and I wouldn't recommend 
it to anyone klutzy enough to remove the file they didn't really want to ;)