本文最后更新于 2024年5月16日。
使用lsof命令查看已经被删除的dc1目录
lsof | grep dc1
报了很多如下错误lsof: no pwd entry for UID 201
加上-w参数
[root@host dc1]# lsof -w | grep dc1
rsyslogd 958 root mem REG 253,1 8388608 19328181 /var/log/journal/20200914151302543507749550121287/system@648eeedc1a184078a509085b963bf9c5-0000000000000001-0005eb62d7d08cb7.journal
rsyslogd 958 root 13r REG 253,1 8388608 19328181 /var/log/journal/20200914151302543507749550121287/system@648eeedc1a184078a509085b963bf9c5-0000000000000001-0005eb62d7d08cb7.journal
rsyslogd 958 967 in:imjour root mem REG 253,1 8388608 19328181 /var/log/journal/20200914151302543507749550121287/system@648eeedc1a184078a509085b963bf9c5-0000000000000001-0005eb62d7d08cb7.journal
rsyslogd 958 967 in:imjour root 13r REG 253,1 8388608 19328181 /var/log/journal/20200914151302543507749550121287/system@648eeedc1a184078a509085b963bf9c5-0000000000000001-0005eb62d7d08cb7.journal
rsyslogd 958 973 rs:main root mem REG 253,1 8388608 19328181 /var/log/journal/20200914151302543507749550121287/system@648eeedc1a184078a509085b963bf9c5-0000000000000001-0005eb62d7d08cb7.journal
rsyslogd 958 973 rs:main root 13r REG 253,1 8388608 19328181 /var/log/journal/20200914151302543507749550121287/system@648eeedc1a184078a509085b963bf9c5-0000000000000001-0005eb62d7d08cb7.journal
bash 1513232 root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
docker-co 1515153 root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
docker-co 1515153 1515352 docker-co root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
docker-co 1515153 1515353 docker-co root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
docker-co 1518112 root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
docker-co 1518112 1518233 docker-co root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
docker-co 1518112 1518234 docker-co root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
docker-co 1525311 root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
docker-co 1525311 1525413 docker-co root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
docker-co 1525311 1525415 docker-co root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
lsof 1537283 root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
grep 1537284 root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
lsof 1537285 root cwd DIR 253,1 6 6274715 /var/lib/docker/volumes/dc1 (deleted)
[root@host dc1]# cd /proc/1513232/fd
[root@host fd]# ll
total 0
lrwx------ 1 root root 64 Dec 3 15:35 0 -> /dev/pts/3
lrwx------ 1 root root 64 Dec 3 15:35 1 -> /dev/pts/3
l-wx------ 1 root root 64 Dec 3 15:35 19 -> /root/.vscode-server/data/logs/20221203T140518/remoteagent.log
lrwx------ 1 root root 64 Dec 3 15:35 2 -> /dev/pts/3
l-wx------ 1 root root 64 Dec 3 15:35 20 -> /root/.vscode-server/data/logs/20221203T140518/ptyhost.log
lrwx------ 1 root root 64 Dec 3 15:35 21 -> /dev/ptmx
lrwx------ 1 root root 64 Dec 3 15:35 24 -> /dev/ptmx
lrwx------ 1 root root 64 Dec 3 15:35 25 -> /dev/ptmx
lrwx------ 1 root root 64 Dec 3 15:35 255 -> /dev/pts/3
lr-x------ 1 root root 64 Dec 3 15:35 3 -> /var/lib/sss/mc/passwd
lrwx------ 1 root root 64 Dec 3 15:35 4 -> 'socket:[117157779]'
l-wx------ 1 root root 64 Dec 3 15:35 99 -> '/root/.vscode-server/bin/b06ae3b2d2dbfe28bca3134cc6be65935cdfea6a/vscode-remote-lock.root.b06ae3b2d2dbfe28bca3134cc6be65935cdfea6a (deleted)'
[root@host fd]# cp 1 ~/deletefile.txt.backup/
cp: cannot create regular file '/root/deletefile.txt.backup/': Not a directory
[root@host fd]# cp 1 ~/deletefile.txt.backup
^C
[root@host fd]# cp 99 ~/deletefile.txt.backup
cp: overwrite '/root/deletefile.txt.backup'?
[root@host fd]# cp 4 ~/deletefile.txt.backup
cp: overwrite '/root/deletefile.txt.backup'?
[root@host fd]#
恢复的数据都是内容为空，看来此方法不适用
“波浪线() 在linux系统的命令行中,表示用户的家目录,超级用户为/root,普通用户为/hom