BashBeginner · Linux with Bash 4+ and the listed tools

Find deleted files still held open

Report unlinked files whose blocks may remain allocated because a process holds them open.

Before you begin

  • Bash 4+ on Linux.
  • Required tools: lsof. lsof may show only your processes. Exit 1 can mean no matches.
What this script changesRead-only local inspection. No packages, service state, permissions, or files are changed. Review output for personal paths, account names, and addresses before sharing.

Set up your example

  1. Save as linux-open-deleted-files.sh.
  2. Open a terminal in its folder.
  3. Run bash "linux-open-deleted-files.sh" --help; invoking bash does not require executable permission.

This recipe uses your own local input or creates its own example output. Follow the setup steps below.

Download the ZIP, extract it, and open a terminal inside the extracted folder. The source file is linux-open-deleted-files.sh.

Run the script

Run command
bash "linux-open-deleted-files.sh"

If your system uses python3 instead of python, use that command for Python examples. Keep paths containing spaces in quotes. Required inputs and optional settings are described in the code and setup steps.

What to expect

An unlinked log may appear; no matches is a valid result.

The complete script

linux-open-deleted-files.sh
#!/usr/bin/env bash
set -euo pipefail
if [[ ${1:-} == --help || ${1:-} == -h ]]; then
cat <<\SCRIPTAGE_HELP
Find deleted files still held open
Usage: bash linux-open-deleted-files.sh 
Report unlinked files whose blocks may remain allocated because a process holds them open.
Read-only local report.
SCRIPTAGE_HELP
exit 0
fi
for tool in lsof; do
  command -v "$tool" >/dev/null 2>&1 || { printf 'Missing required tool: %s\n' "$tool" >&2; exit 1; }
done
set +e
lsof +L1
status=$?
set -e
if (( status > 1 )); then printf 'lsof failed: %s\n' "$status" >&2; exit "$status"; fi

Open source as plain text · Download source and sample files

How it works

  1. Report unlinked files whose blocks may remain allocated because a process holds them open.
  2. Required commands are checked before collecting the report.
  3. The output is a local snapshot; restricted permissions or unavailable kernel data can limit visibility.

Make it your own

Adjust scope

Review COMMAND, PID, SIZE/OFF, and NAME. Do not terminate a process without investigating its owner.

Save a snapshot

Redirect to a new unused .txt filename for comparison. Shell redirection can overwrite files; choose a fresh name.

Change one setting at a time, run it again on sample data, and compare the output. The customization guide walks through this process.

If something goes wrong

A required tool is missing.

Install its package through your normal distribution maintenance process. This script does not install anything.

The report is empty or permission is denied.

lsof may show only your processes. Exit 1 can mean no matches.

Reference & next steps

These official references explain the underlying tools. The Scriptage example and guide are original instructional content. See verification notes for what has been checked and the limits of those checks.

Copies a template for your own notes. It does not send anything.