Mon Nov 21 22:34:51 EST 2011

Recovering deleted files.

Suppose you have a file called '/tmp/foo' that is deleted from the
directory, but still opened by a process.  You can still get at it by

   lsof | grep /tmp/foo

To find the process that owns it.  Then issuing

   ls -l /proc/1234/fd

to find the fd of the deleted file.  Using

   cp /proc/1234/fd/4 /tmp/foo.saved

the file can be restored.