Master lsof: Inspect Open Files, Sockets, and Recover Deleted Data on Linux

What is lsof?

lsof (list open files) is a Linux utility that shows which files, directories, network connections, and hardware devices are opened by processes. Since everything in Linux is a file, lsof can also display sockets and ports.

Common Options

-a – treat subsequent options as logical AND

-c <process_name> – show files opened by processes matching the name

-d <fd> – list processes using a specific file descriptor

+d <directory> – show files opened in a directory (non‑recursive)

+D <directory> – show files opened in a directory recursively

-i [<criteria>] – list network‑related files

-n – do not resolve host names

-p <pid> – show files opened by a specific PID

-P – do not resolve port numbers

-t – output only PIDs

-u <user> – show files opened by a specific user

-U – list opened UNIX domain socket files

-h – display help

-v – display version

Basic Output

Running lsof without options lists every open file on the system, which is usually overwhelming. A typical useful invocation is to inspect the current Bash process: sudo lsof $$ The columns are:

COMMAND – program name

PID – process ID

USER – owner

FD – file descriptor (e.g., cwd, txt, mem, numeric values)

TYPE – file type (REG, DIR, CHR, BLK, FIFO, IPv4, IPv6, etc.)

DEVICE – device numbers

SIZE – size in bytes

NODE – inode number

NAME – full file name

Typical Use Cases

Find processes that have a specific file open

sudo lsof /bin/bash

Find processes that have opened a directory (non‑recursive)

sudo lsof +d /var/log

Find processes that have opened a directory recursively

sudo lsof +D /var/log

Show files opened by a given PID

sudo lsof -p 1152

Combine options with logical AND

sudo lsof -a -p $$ -d0,1,2

This lists files of the current shell whose descriptors are 0, 1, or 2.

Search by program name (supports regex)

sudo lsof -c cr

sudo lsof -c ^cr

sudo lsof -c /cr[ao]/

List network‑related files

sudo lsof -i

Use -i4 or -i6 to restrict to IPv4 or IPv6, and -i:22 to show only port 22.

List UNIX domain sockets opened by sshd

sudo lsof -a -c sshd -U

Show files opened by a specific user

sudo lsof -u syslog

Exclude a user

sudo lsof -i -u ^nick

Kill all processes of a user that have files open

kill -9 $(lsof -t -u nick)

Count total open files

sudo lsof -P -n | wc -l

Recover a deleted file

If a file is deleted while a process still holds it open, the data remains accessible via the process's file descriptor under /proc/<pid>/fd. Example to restore /var/log/syslog:

sudo rm /var/log/syslog
sudo tail -n 5 /proc/1141/fd/7
sudo sh -c 'cat /proc/1141/fd/7 > /var/log/syslog'
sudo chown syslog:adm /var/log/syslog
sudo systemctl restart rsyslog.service

Help

Use lsof -h to display a brief help message; for full details consult the man page.

Conclusion

lsof is a powerful, feature‑rich command. Starting with the examples above helps you avoid the overwhelming man page and gradually master its capabilities.