Linux file deleted recovery

Question

Is there a way to create a file in Linux that link to a specific iNode? Take this scenario: There is a file that is in course of writing (a log maybe) and the specific file is d

Answer 1

Since there is no Syscall that involves iNode, because is a concept of extX fs and is not a good practice make a stove pipe but it is to make a chain of responsability (as M.E.L. suggests), there is only a NO answer for this question because at VFS level we handle files path and names and not other internal representations.

BUT to achieve the goal to track the most last modification we can use a continous monitoring and duplication with tail:

tail -c+1 -f --pid=PID /proc/PID/fd/FD > /path/to/the/copy

where PID is the pid of the process that have the deleted file still opened and FD is its file descriptor number. With -f tail open and hold the file to display further modification, with -c+1 start to "tail" from the first byte and with --pid=PID tail is informed to exit when the pid exit.