{"id":2196,"date":"2017-12-07T13:00:51","date_gmt":"2017-12-07T13:00:51","guid":{"rendered":"http:\/\/www.scmgalaxy.com\/tutorials\/?p=2196"},"modified":"2021-02-27T09:29:14","modified_gmt":"2021-02-27T09:29:14","slug":"recovering-a-recently-opended-deleted-files","status":"publish","type":"post","link":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/","title":{"rendered":"Recovering a Recently opended deleted files"},"content":{"rendered":"

rajeshkumar created the topic: Recovering a Recently opended deleted files<\/strong>
\nRecovering a Recently opended deleted files
\nBy using lsof, you can recover a deleted file that was opened already. This comes very handy when attacker gain access to the systems and has executed commands or has done some configuration changes, and then removes the log file(s) to erase evidence. A sysadmin can use this method to recover the filles which has been opened by some processess to check what all the hacker has changed.<\/p>\n

The lsof – list open file is the command used for this:<\/p>\n

lsof | grep “syslog” (List processess which has this file opened)<\/p>\n

rsyslog\t998\troot\t1w\tREG\t8,3\t141400\t1237857\t\/var\/log\/syslog<\/p>\n

Here the process 990 (PID) has opened the file ‘\/var\/log\/syslog’ with the descriptor a ‘1’(1W).<\/p>\n

To recover the content of the file, just run the following commands…<\/p>\n

cat \/proc\/990\/fd\/1 > syslog.safe<\/p>\n

you will have the content of the file stored in syslog.safe
\nRegards,
\nRajesh Kumar
\nTwitt me @ twitter.com\/RajeshKumarIn<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

rajeshkumar created the topic: Recovering a Recently opended deleted files Recovering a Recently opended deleted files By using lsof, you […]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[454],"tags":[458],"class_list":["post-2196","post","type-post","status-publish","format-standard","hentry","category-shell-script","tag-recently"],"yoast_head":"\nRecovering a Recently opended deleted files - scmGalaxy<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Recovering a Recently opended deleted files - scmGalaxy\" \/>\n<meta property=\"og:description\" content=\"rajeshkumar created the topic: Recovering a Recently opended deleted files Recovering a Recently opended deleted files By using lsof, you […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/\" \/>\n<meta property=\"og:site_name\" content=\"scmGalaxy\" \/>\n<meta property=\"article:published_time\" content=\"2017-12-07T13:00:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-02-27T09:29:14+00:00\" \/>\n<meta name=\"author\" content=\"scmgalaxy K\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"scmgalaxy K\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/recovering-a-recently-opended-deleted-files\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/recovering-a-recently-opended-deleted-files\\\/\"},\"author\":{\"name\":\"scmgalaxy K\",\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/#\\\/schema\\\/person\\\/fc12ad190f540e79460243c81148d102\"},\"headline\":\"Recovering a Recently opended deleted files\",\"datePublished\":\"2017-12-07T13:00:51+00:00\",\"dateModified\":\"2021-02-27T09:29:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/recovering-a-recently-opended-deleted-files\\\/\"},\"wordCount\":173,\"commentCount\":0,\"keywords\":[\"Recently\"],\"articleSection\":[\"Shell Script\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/recovering-a-recently-opended-deleted-files\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/recovering-a-recently-opended-deleted-files\\\/\",\"url\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/recovering-a-recently-opended-deleted-files\\\/\",\"name\":\"Recovering a Recently opended deleted files - scmGalaxy\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/#website\"},\"datePublished\":\"2017-12-07T13:00:51+00:00\",\"dateModified\":\"2021-02-27T09:29:14+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/#\\\/schema\\\/person\\\/fc12ad190f540e79460243c81148d102\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/recovering-a-recently-opended-deleted-files\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/recovering-a-recently-opended-deleted-files\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/recovering-a-recently-opended-deleted-files\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Recovering a Recently opended deleted files\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/#website\",\"url\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/\",\"name\":\"scmGalaxy\",\"description\":\"A Platform for Software Engineers\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/#\\\/schema\\\/person\\\/fc12ad190f540e79460243c81148d102\",\"name\":\"scmgalaxy K\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4b902ea8c77ee0a326c112f29d0edf51b7c3e1cd05c4fb92a810177e9c3f12a9?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4b902ea8c77ee0a326c112f29d0edf51b7c3e1cd05c4fb92a810177e9c3f12a9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4b902ea8c77ee0a326c112f29d0edf51b7c3e1cd05c4fb92a810177e9c3f12a9?s=96&d=mm&r=g\",\"caption\":\"scmgalaxy K\"},\"sameAs\":[\"http:\\\/\\\/www.DevOpsSchool.com\"],\"url\":\"https:\\\/\\\/www.scmgalaxy.com\\\/tutorials\\\/author\\\/scmgalaxy\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Recovering a Recently opended deleted files - scmGalaxy","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/","og_locale":"en_US","og_type":"article","og_title":"Recovering a Recently opended deleted files - scmGalaxy","og_description":"rajeshkumar created the topic: Recovering a Recently opended deleted files Recovering a Recently opended deleted files By using lsof, you […]","og_url":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/","og_site_name":"scmGalaxy","article_published_time":"2017-12-07T13:00:51+00:00","article_modified_time":"2021-02-27T09:29:14+00:00","author":"scmgalaxy K","twitter_card":"summary_large_image","twitter_misc":{"Written by":"scmgalaxy K","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/#article","isPartOf":{"@id":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/"},"author":{"name":"scmgalaxy K","@id":"https:\/\/www.scmgalaxy.com\/tutorials\/#\/schema\/person\/fc12ad190f540e79460243c81148d102"},"headline":"Recovering a Recently opended deleted files","datePublished":"2017-12-07T13:00:51+00:00","dateModified":"2021-02-27T09:29:14+00:00","mainEntityOfPage":{"@id":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/"},"wordCount":173,"commentCount":0,"keywords":["Recently"],"articleSection":["Shell Script"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/","url":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/","name":"Recovering a Recently opended deleted files - scmGalaxy","isPartOf":{"@id":"https:\/\/www.scmgalaxy.com\/tutorials\/#website"},"datePublished":"2017-12-07T13:00:51+00:00","dateModified":"2021-02-27T09:29:14+00:00","author":{"@id":"https:\/\/www.scmgalaxy.com\/tutorials\/#\/schema\/person\/fc12ad190f540e79460243c81148d102"},"breadcrumb":{"@id":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.scmgalaxy.com\/tutorials\/recovering-a-recently-opended-deleted-files\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.scmgalaxy.com\/tutorials\/"},{"@type":"ListItem","position":2,"name":"Recovering a Recently opended deleted files"}]},{"@type":"WebSite","@id":"https:\/\/www.scmgalaxy.com\/tutorials\/#website","url":"https:\/\/www.scmgalaxy.com\/tutorials\/","name":"scmGalaxy","description":"A Platform for Software Engineers","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.scmgalaxy.com\/tutorials\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.scmgalaxy.com\/tutorials\/#\/schema\/person\/fc12ad190f540e79460243c81148d102","name":"scmgalaxy K","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4b902ea8c77ee0a326c112f29d0edf51b7c3e1cd05c4fb92a810177e9c3f12a9?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4b902ea8c77ee0a326c112f29d0edf51b7c3e1cd05c4fb92a810177e9c3f12a9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4b902ea8c77ee0a326c112f29d0edf51b7c3e1cd05c4fb92a810177e9c3f12a9?s=96&d=mm&r=g","caption":"scmgalaxy K"},"sameAs":["http:\/\/www.DevOpsSchool.com"],"url":"https:\/\/www.scmgalaxy.com\/tutorials\/author\/scmgalaxy\/"}]}},"_links":{"self":[{"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/posts\/2196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/comments?post=2196"}],"version-history":[{"count":1,"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/posts\/2196\/revisions"}],"predecessor-version":[{"id":2197,"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/posts\/2196\/revisions\/2197"}],"wp:attachment":[{"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/media?parent=2196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/categories?post=2196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.scmgalaxy.com\/tutorials\/wp-json\/wp\/v2\/tags?post=2196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}