Re: [OT] Recovering a deleted file that is still open

[NN_il_Confusionario <pinkof.pallus@tiscalinet.it>]

>     * From: Raj Kiran Grandhi <grajkiran@gmail.com>
> If I have accidentally deleted a file that is still being used by some
> application (read or write mode), is it possible to recover such a file? Especially since
> the file is not really deleted until the descriptor is closed by the application?

yes, for example using lsof and coping with cp a file from proc. A
google search explains this.

If with 

lsof|grep deletd

you find that the file descriptor 4 of process with pid 14243
corresponds to /path/to/the/deleted/file then

cp -pu /proc/14243/fd/4 /path/to/the/deleted/file.SAVED

(I am from memory, do a google search to find the exact commands)