If a macOS/linux process still has a deleted file open, you can recover it entirely using the open file descriptor — even if the file has been deleted from disk!
This guide shows how to do it using mpv
’s IPC interface and embedded Lua scripting. Don't close the mpv
process and hopefully it already has a IPC interface set. The general approach is generic, but you need a way to get the running process itself to perform the fd copy. We take advantage of mpv's ability to run arbitary lua code.
lsof -p <PID_OF_MPV>;
Look for a line like:
mpv 25562 chris 12r REG ... /private/tmp/my_deleted_file.mp4
Take note of the FD number (e.g. 12
).
Create the following file as /tmp/mpv_recovered_deleted.lua
, and update the FD number if necessary:
-- Pure Lua recovery script for mpv
local in_fd = io.open("/dev/fd/12", "rb") -- <-- update 12 if needed
local out = io.open("/tmp/recovered.mp4", "wb")
if in_fd and out then
while true do
local chunk = in_fd:read(65536)
if not chunk then break end
out:write(chunk)
end
in_fd:close()
out:close()
print("Recovery complete.")
else
print("Failed to open one of the files.")
end
mpv
, or you'll only get a partial file.
Send the script into the running mpv
process using its IPC socket (/tmp/MPV_IPC.sock
in this example):
echo "load-script '/tmp/mpv_recovered_deleted.lua'" | socat - /tmp/MPV_IPC.sock
You should now see /tmp/recovered.mp4
appear with the full contents of the deleted-but-open file!