How to recover a deleted file (but still being opened) in Linux?

Answer:

If you have a file which is deleted but is still opening in another program, it is possible to recover it.

Let do a quick experiment:

# echo "hello" > /tmp/test.txt
# less /tmp/test.txt # Open this file

Now, in another terminal, we delete it

# rm /tmp/test.txt

To recover it, we need to find the pid of the program (less in our example) which is opening this file

# ps ax | grep less
31314 pts/0    S+     0:00 less test

Then we list the file descriptor being used by this program

# ls -l /proc/31314/fd

lr-x------ 1 joe joe 64 2012-07-05 08:56 4 -> /tmp/test (deleted)

Finally we can easily recover the content by

# cp /proc/31314/fd/4 /tmp/test.txt