Emptying “Deleted” Files

A few days ago, I woke to find my home partition 100% full and programs erroring out because of it.

“No problem,” I thought and fired up ncdu to figure out what had eaten up the 12GiB I’d had free the night before. (Nothing beats ncdu for efficient workflow though FileLight is a good alternative if you’re willing to trade keyboard shortcuts for a GUI)

Nothing showed up so, on a hunch, I tried using lsof to see if it was a deleted file being held in existence by an open file handle. Bingo!

…it was the ~/.xsession-errors that I’d deleted weeks ago, it was being held open by half the apps on my desktop (including my session manager), and I had in-progress tasks that I couldn’t interrupt to restart my session. Here’s where it got tricky. I had to somehow get rid of a file that was already “deleted” when I no longer had a name to reference it by.

Thankfully, after a fair bit of searching, I found a solution. The key lies in how, on Linux, you can access all open files via /proc if you know the process’s PID, even if they’ve been deleted. (It’s the second column in the lsof output. You’ll also need the file descriptor number, but you can trial-and-error that using something like less)

Once you’ve got that, you can use a root shell to truncate the file to a length of zero.

you@host:~# > /proc/<PID>/fd/<FD>

(Yes, that’s using a non-appending redirect without providing a command to redirect output from)

I hope this helps if you ever find yourself in a similar situation.

Emptying “Deleted” Files by Stephan Sokolow is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.