2

Okay, on Linux, when I delete a running executable or script, it usually (for me, pretty much always, but I don't know if it will work in every case) continues to run without any problems. So I've got two questions here:

  1. Where is the running executable/script being run from? RAM memory?
  2. If stored in RAM or where ever, is there a way to extract the executable/script from that location?

If it makes any difference, I'm using Ubuntu 11.04.

Improve this question
0

1 Answer 1

Reset to default
5

When you delete a file on Linux the file remains on the disk (although not visible) until the last file descriptor pointing to it has been closed. Only then (e.g., when the executable terminates) will the file actually be de-allocated from the disk. The data is still accessible by any program which still has an open file-handle to the data - be that as a script or as just a data file.

As peth said, the file should be available under the /proc/[pid]/fd entry for any process that has an open file descriptor to it.

lsof can also show you which processes still have a descriptor open to the file in question.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .