I have deleted a file I still have open. I want to save that file. I know its inode number.

I think that sleuthtools icat would work for me except for the following.

$ sudo icat -f hfs /dev/disk0s2 3720257 > /path/to/some_new_filename

Error opening image file (raw_open: file "/dev/disk0s2" - Resource busy)

Since the block disk /dev/disk0s2 is in use by the Kernel, use the raw disk:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .