Opened files can be listed using the lsof utility. Deleted ones are shown like this:

# lsof
COMMAND     PID   TID USER   FD      TYPE     DEVICE SIZE/OFF     NODE NAME
[...]
plugin-co  6640       n0-1   17r      REG      254,1 10279214  2621682 /tmp/FlashXXcHpDke (deleted)
[...]

in order to recover it, one can use the procfs entry for that open fd:

# ls -l /proc/6640/fd/17
lr-x------ 1 n0-1 n0-1 64 May 30 23:47 /proc/6640/fd/17 -> /tmp/FlashXXcHpDke\ (deleted)

retrieving it is as easy as eatin' pancakes:

# cp /proc/6640/fd/17 /tmp/FlashXXcHpDke.flv

• Bring back deleted files with lsof