已打开文件，如果从磁盘上删除了这个文件，磁盘inode数据已经改变，难以找回。
但是文件没有关闭，进程没有退出之前，可以从/proc里找到文件fd, 并且读出其中的内容
linux-d4xo:~/temp/test # ls /proc/53712/fd/ -l total 0 lrwx------ 1 root root 64 Sep 19 02:39 0 -> /dev/pts/1 lrwx------ 1 root root 64 Sep 19 02:39 1 -> /dev/pts/1 lrwx------ 1 root root 64 Sep 19 02:39 2 -> /dev/pts/1 lrwx------ 1 root root 64 Sep 19 02:39 3 -> /mnt/lv1/aaaa linux-d4xo:~/temp/test # rm /mnt/lv1/aaaa linux-d4xo:~/temp/test # lsof /mnt/lv1 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME a.out 53712 root 3u REG 254,0 14 14 /mnt/lv1/aaaa (deleted) linux-d4xo:~/temp/test # ls /proc/53712/fd/ -l total 0 lrwx------ 1 root root 64 Sep 19 02:39 0 -> /dev/pts/1 lrwx------ 1 root root 64 Sep 19 02:39 1 -> /dev/pts/1 lrwx------ 1 root root 64 Sep 19 02:39 2 -> /dev/pts/1 lrwx------ 1 root root 64 Sep 19 02:39 3 -> /mnt/lv1/aaaa (deleted) linux-d4xo:~/temp/test # cat /mnt/lv1/aaaa cat: /mnt/lv1/aaaa: No such file or directory linux-d4xo:~/temp/test # cat /proc/53712/fd/3 hello test rm linux-d4xo:~/temp/test # dd if=/proc/53712/fd/3 of=/cccc 0+1 records in 0+1 records out 14 bytes copied, 0.000238676 s, 58.7 kB/s linux-d4xo:~/temp/test # cat /cccc hello test rm
转自https://blog.csdn.net/sinat_38723234/article/details/101025897#comments_17906042