Recovery deleted Plone's Data.fs

Simply recipe describing recovery of deleted files within lsof

Disclaimer

Following method works only if you accidentally deleted your file / directory and your Plone instance is still working (technically spekaing, it is still keeping opened filed descriptors).

Accident and recovery

Few days ago I was experiment with my Plone instance and accidentally wiped out full filestorage directory, a location where Plone stores Data.fs file with all the data. I had the back from previously day, but I didn't want to loose latest changes. Ironically, I wanted to removed old backup of this directory...

In first place I have chekced if Plone survived this hack:

(personal)root@idoru / # ps axu |grep instance
bluszcz   1596  0.0  3.1 556376 257076 ?       Sl   ago05 103:47 /home/bluszcz/dev.bluszcz.net/Python-2.6/bin/python /home/bluszcz/dev.bluszcz.net/buildout-cache/eggs/Zope2-2.13.18-py2.6.egg/Zope2/Startup/run.py -C /home/bluszcz/dev.bluszcz.net/zinstance/parts/instance/etc/zope.conf
(personal)root@idoru / #

Using lsof I have checked what happened with created by Plone file descriptors:

(personal)root@idoru / # lsof -np 1596 2>/dev/null |grep Data.fs 
python  1596 bluszcz    7uW  REG    9,2         6  1279892 /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs.lock (deleted)
python  1596 bluszcz   14u   REG    9,2      4010  1279893 /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs.tmp (deleted)
python  1596 bluszcz   15u   REG    9,2  76508675  1279894 /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs (deleted)
python  1596 bluszcz   16r   REG    9,2  76508675  1279894 /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs (deleted)
python  1596 bluszcz   17r   REG    9,2  76508675  1279894 /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs (deleted)
(personal)root@idoru / #

There were still there! I made another check trough the /proc:

(personal)root@idoru / # ls -l /proc/1596/fd/* |grep Data
lrwx------ 1 bluszcz bluszcz 64 nov 28 23:51 /proc/1596/fd/14 -> /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs.tmp (deleted)
lrwx------ 1 bluszcz bluszcz 64 nov 28 23:51 /proc/1596/fd/15 -> /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs (deleted)
lr-x------ 1 bluszcz bluszcz 64 nov 28 23:51 /proc/1596/fd/16 -> /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs (deleted)
lr-x------ 1 bluszcz bluszcz 64 nov 28 23:51 /proc/1596/fd/17 -> /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs (deleted)
lrwx------ 1 bluszcz bluszcz 64 nov 28 23:51 /proc/1596/fd/7 -> /home/bluszcz/dev.bluszcz.net/zinstance/var/filestorage/Data.fs.lock (deleted)
(personal)root@idoru / #

So I copied them to another location:

(personal)root@idoru / # cp /proc/1596/fd/7 /home/bluszcz/dev.bluszcz.net/zinstance/var-recovery/filestorage/Data.fs.lock
(personal)root@idoru / # cp /proc/1596/fd/14 /home/bluszcz/dev.bluszcz.net/zinstance/var-recovery/filestorage/Data.fs.tmp
(personal)root@idoru / # cp /proc/1596/fd/16 /home/bluszcz/dev.bluszcz.net/zinstance/var-recovery/filestorage/Data.fs.copy