Emptying “Deleted” Files

A few days ago, I woke to find my home partition 100% full and programs erroring out because of it.

“No problem,” I thought and fired up ncdu Install via APT to figure out what had eaten up the 12GiB I’d had free the night before. (Nothing beats ncdu for efficient workflow though FileLight Install via APT is a good alternative if you’re willing to trade keyboard shortcuts for a GUI)

Nothing showed up so, on a hunch, I tried using lsof Install via APT to see if it was a deleted file being held in existence by an open file handle. Bingo!

…it was the ~/.xsession-errors that I’d deleted weeks ago, it was being held open by half the apps on my desktop (including my session manager), and I had in-progress tasks that I couldn’t interrupt to restart my session. Here’s where it got tricky. I had to somehow get rid of a file that was already “deleted” when I no longer had a name to reference it by.

Thankfully, after a fair bit of searching, I found a solution. The key lies in how, on Linux, you can access all open files via /proc if you know the process’s PID, even if they’ve been deleted. (It’s the second column in the lsof output. You’ll also need the file descriptor number, but you can trial-and-error that using something like less)

Once you’ve got that, you can use a root shell to truncate the file to a length of zero.

you@host:~# > /proc/<PID>/fd/<FD>

(Yes, that’s using a non-appending redirect without providing a command to redirect output from)

I hope this helps if you ever find yourself in a similar situation.

CC BY-SA 4.0 Emptying “Deleted” Files by Stephan Sokolow is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

This entry was posted in Geek Stuff. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

By submitting a comment here you grant this site a perpetual license to reproduce your words and name/web site in attribution under the same terms as the associated post.       Also, please be aware that non-constructive comments will have their URL field erased before being approved in order to combat SEO spam.