In Linux machine sometime we encounter some strange cases in which we found Linux deleted files didn’t get reflected in disk space. So it work like we delete some big files from disk and expect some increase in free potential space. But we didn’t why, what exactly happened to that space which we deleted and still not reflect on free space. SO we have some question with this.

1. Why it happened and How we can identify these files and their details
2. Where these files gone once they deleted and not reflect from file system
3. Can we reflect files size back to file system.What are possible ways to clear to do this
4. If these files are not recovered in file system, so possible they are still somewhere, S0 can we recover these files from there.

identify Deleted files

So basically when we are working on Linux machine with some process which is working or using some file like big size file and if during using this file through process we delete this file, so Linux will unlink the file from file-syste’s directory structure however process mechanism will remain with its file descriptor which is good because that also lead to way to get this file back in case we deleted this file accidentally.But it also has its downside as file size is comes up as free usable size in disk.

TO identify deleted files we can we can easily able to see them through lsof command with below options

# lsof +L1  -- In all file system

# lsof +aL1  Mount-point -- In a particular mount-point

I have also tried to replicate it on one of machine and had found this below output

# srv1:/proc/4031618/fd# df -hTP /tmp
Filesystem                 Type  Size  Used Avail Use% Mounted on
/dev/mapper/vg_root-lv_tmp ext3  7.9G  7.3G  399M  90% /tmp

srv1:~# lsof +aL1 /tmp
chrome	   581753     u2    2w   REG  253,2 13061347514     0 131105 /tmp/chrome/C-u2-104-1532437026_snNew.session_chrome_dp24/session.log (deleted)
chrome     581753     u2    9w   REG  253,2 13061347514     0 131105 /tmp/chrome/C-u2-104-1532437026_snNew.session_chrome_dp24/session.log (deleted)

With above command, we can see deleted files for particular mount point. Every single file processing in Linux should have two minimum link, but if any files that have only one link that means its has been deleted from file system and only in RAM with existing file descriptor pointing with same size.

So now we know details of files deleted and process that was using those files. Now we can do some work to back our space on mount-point.

How to recover this file-system

With this we an do two things, either we can recover this file back on file-system or recover file-system size to same as it should be after deleting those files.

We just need to nullify these deleted files through echo command used in Linux for print something on terminal or in script like below.
For this we need to use proc file system, we need to locate file descriptor of file in PID directory like /proc/581753/fd and nullify on it like below.

# srv1:/proc/581753/fd# ll | grep deleted 
l-wx------ 1 u2 u2  64 Apr 30 17:13 2 ->  /tmp/chrome/C-u2-104-1532437026_snNew.session_chrome_dp24/session.log (deleted)
l-wx------ 1 u2 u2  64 Apr 30 17:13 9 ->  /tmp/chrome/C-u2-104-1532437026_snNew.session_chrome_dp24/session.log (deleted)

# srv1:/proc/581753/fd# echo > 2
# srv1:/proc/581753/fd# echo > 9
# srv1:/proc/581753/fd# df -hTP /tmp
Filesystem                 Type  Size  Used Avail Use% Mounted on
/dev/mapper/vg_root-lv_tmp ext3  7.9G  134M  7.5G   4% /tmp

So in above commands and its output, we can see how we can nullify files and retain file system size as it should be.

So next Question, can we back that file if we accidentally deleted it, sure you can but not after nullify it. We can only nullify it before it, so it have all its content and we just point it again back of file point in file-system.For this we just need to copy this file descriptor back to same file name like below.

# cp 2 /tmp/chrome/C-u2-104-1532437026_snNew.session_chrome_dp24/session.log

This above command will retain file back to its normal space which was earlier was not visible to normal viewing.