Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Okay, on Linux, when I delete a running executable or script, it usually (for me, pretty much always, but I don't know if it will work in every case) continues to run without any problems. So I've got two questions here:

  1. Where is the running executable/script being run from? RAM memory?
  2. If stored in RAM or where ever, is there a way to extract the executable/script from that location?

If it makes any difference, I'm using Ubuntu 11.04.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

When you delete a file on Linux the file remains on the disk (although not visible) until the last file descriptor pointing to it has been closed. Only then (e.g., when the executable terminates) will the file actually be de-allocated from the disk. The data is still accessible by any program which still has an open file-handle to the data - be that as a script or as just a data file.

As peth said, the file should be available under the /proc/[pid]/fd entry for any process that has an open file descriptor to it.

lsof can also show you which processes still have a descriptor open to the file in question.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.