How to get the filename of which has been deleted if I know the inode number.
i can use the command "istat" to get the inode number of the file.
# istat
/proc/[pid]/fd/x
If this file has been deleted,but the process of this file has not been closed and handle has not been released ,so this file has not been released yet.
then ,how can i get the path of which it has been deleted before if i know the inode number in AIX?
i have tried both in AIX and LINUX.
I can't get the path by using "lsof" in AIX,but it works well in LINUX.
Thank you Garethr!
---------- Post updated at 07:08 PM ---------- Previous update was at 05:44 PM ----------
I make a test here.
the file "test" under /home is deleted when it runs on "nohup".
because of the handle of "test" is not released so taht The space of /home is not released after deleted "test".
IF ADMINISTRATOR DOESN'T KNOW WHO REMOVED THE "test" AND WHAT THE REMOVED FILENAME IS,HE JUST CAN INPUT"fuser -dV /home" AND GET an INODE NUMBER,HOW CAN HE GET THIS FILENAME "test".
You will need to supply the inode and the filesystem that it came from.
If the file has been deleted - meaning ALL instances of it - then this command will not work as it uses filesystem directory entires to make the connection between a filename and the inode.
When you rm a file, you are actually un-linking it. This means that you are removing the directory entry and releasing the inode. So if you still have the file open, and it has been deleted (rm'ed) then it does not have a name (anymore).
Of course it is possible to have multiple (hard) links to a file - and therefore it would be possible to find a filename although it would not be the same as the deleted name. (name = full path to file).
The ncheck command (as well as other AIX info) can be found here: