Ubuntu

i delete a file that is being written to - where does the data being written go?

Asked by Shriramana Sharma

Hello. To test this, go to a terminal and do:

$ cd /tmp
$ dd if=/dev/urandom of=foofile bs=1M count=50

Open another terminal and do cd /tmp in that too. Now in any one terminal, do:

$ cp foofile goofile

and *immediately* (before this cp command completes (which is why I created a 50 MB file) go to the other terminal and do:

$ rm goofile

Now go back to the terminal with the cp command. You find that the copy apparently completes successfully without any error messages. However, there is no goofile anymore. So my questions:

1. where does the data go?
2. is it possible to recover the data? In case of mv across partitions it would be important though not in case of cp, or case of mv in same partition (which is too fast for us to delete the target file before its completion. Just try mv foofile /mnt/anotherpartition/goofile and in another terminal (which is already at /mnt/anotherpartition) do rm goofile before the mv operation is "completed".

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Andy Ruddock (andy-ruddock) said : 		#1

The kernel keeps files open until there are no more processes using that file. So goofile is kept open by the kernel until the cp completes (the data is written to disk as normal).
When cp completes the file is closed and, as it is no longer open by any processes, it is deleted.
The data may possibly be recovered, although there are no guarantees that the data was ever physically written to a disk or that the space used by the file is not immediately overwritten. Thast depends upon the filesystem and the hardware.

This process of immediately deleting files is used by programs which may have "lock" file to indicate when they running. If the program which creates (and immediately deletes) the file, crashes for some reason the lock file is cleared up by the kernel automatically.

Revision history for this message
Shriramana Sharma (jamadagni) said : 		#2

So you are saying that the file is not really deleted until the process that has it opened exits. So if the cp has not yet completed, and I find out my error of deleting the file, is there anyway I can recover the file, i.e. undo the delete before the copy has completed and allows the kernel to unlink my file?

Revision history for this message
Shriramana Sharma (jamadagni) said : 		#3

Weird thing is that, while rm goofile works immediately on the other terminal, mv goofile /anotherpartition/goofile seems to wait for cp on this terminal to exit before doing its work. Wonder why.

Revision history for this message
Andy Ruddock (andy-ruddock) said : 		#4

I'm not sure a process is able to open a file which has been deleted, even though it may still be open in another process.
A file can be deleted while it's still open, this is a deferrable event. Copying or moving the file requires that the file be closed, or at least that it be able to be opened for read.
This is all dependent upon the filesystems being used, and you're into the realms of race conditions which the kernel team has worked diligently to prevent for many years.
If you want to see what's going on during these cp/mv/rm processes run them under strace (apt-get install strace).

Can you help with this problem?

Provide an answer of your own, or ask Shriramana Sharma for more information if necessary.

To post a message you must log in.