Home / ubuntu / Questions / 146507
Accepted
Richard
Asked: 2012-06-05 12:42:04 +0800 CST

Is it possible to recover unflushed data from the disk/page cache?

  • 772

In Ubuntu, I move some file to a USB stick, using mv dir/file /media/7EXXX/swap/. When finishing this, I forget to "safely remove" before physically removing usb stick. Now, the file is not shown in usb. Is it possible to retrieve data not yet written to USB (which I assume resides on page/disk cache).

kernel

1 Answers

  1. Best Answer

    The simple answer is "No, sorry, but your data's gone" :(

    Shutdown as soon as possible (maybe even uncleanly) and use a LiveCD, etc. to mount your source partition and recover the file with testdisk/photorec, etc.

    Remember to append a ; sync next time so you know the file has been written to the USB when the prompt reappears.

    In general it's almost impossible to retrieve data from the file cache unless you can somehow find what the "page cache" process is, and then there would be other issues.

    You can examine and dump the contents of a process's memory from /proc/$pid/mem with a debugger such as gdb -- but the process must be able to be SIGSTOPped. So: the requirements to dump the file cache to a disk file for analysis and possible recovery with testdisk, photorec, etc. are something like:

    • Find the elusive "page cache" process
    • Make sure it's stoppable
    • Dump its memory to disk
    • All without rebooting

    Someone who has significant experience with kernel development could probably put together some code to do this...

    • 2