Viewing deleted-but-open files on Linux

On Linux, a file may be deleted (removed/unlinked) while a process has it open.  When this happens, the file is essentially invisible to other processes, but it still takes on physical space on the drive.  To find out how much space is taken up by these files, run:

sudo lsof | awk '/deleted/ {sum+=$7} END {print sum}'

lsof will list all open files.  awk then searches for the deleted ones and sums up the file sizes (in bytes).

It turns out that you can use lsof and the /proc filesystem to recover deleted files, as long as some process has them open.

One Trackback

  1. By site on April 26, 2017 at 1:05 am


    Viewing deleted-but-open files on Linux – Blog

Post a Comment

Your email is never shared. Required fields are marked *