====== File Recovery ======
===== Deleted But Still Open Files =====
Opened files can be listed using the ''lsof'' utility. Deleted ones are shown like this:
  # lsof
  COMMAND     PID   TID USER   FD      TYPE     DEVICE SIZE/OFF     NODE NAME
  [...]
  plugin-co  6640       n0-1   17r      REG      254,1 10279214  2621682 /tmp/FlashXXcHpDke (deleted)
  [...]
in order to recover it, one can use the procfs entry for that open fd:
  # ls -l /proc/6640/fd/17
  lr-x------ 1 n0-1 n0-1 64 May 30 23:47 /proc/6640/fd/17 -> /tmp/FlashXXcHpDke\ (deleted)
retrieving it is as easy as eatin' pancakes:
  # cp /proc/6640/fd/17 /tmp/FlashXXcHpDke.flv

====== Links ======
  * [[http://www.linux.com/archive/feed/58142|Bring back deleted files with lsof]]