Recover the deleted file!

A file as it appears somewhere on a Linux file system is actually just a link to an inode, which contains all of the file’s properties, such as permissions and ownership, as well as the addresses of the data blocks where the file’s content is stored on disk. When you rm a file, you’re removing the link that points to its inode, but not the inode itself; other processes (such as your audio player) might still have it open. It’s only after they’re through and all links are removed that an inode and the data blocks it pointed to are made available for writing.

This is where the Linux process pseudo-filesystem, the /proc directory, comes into play. Every process on the system has a directory here with its name on it, inside of which lies many things — including an fd (“file descriptor”) subdirectory containing links to all files that the process has open. Even if a file has been removed from the file system, a copy of the data will be right here:

/proc/process id/fd/file descriptor

Here is a live example:

create a file which you can delete.

[root@DeathStar mystuff] man lsof > myfile
[root@DeathStar mystuff]less myfile and press Ctrl+Z so that it maintains fd open.
[root@DeathStar mystuff]# rm myfile
rm: remove regular file `myfile'? y
removed `myfile'
[root@DeathStar mystuff]# lsof |grep myfile
less 23772 root 4r REG 8,2 113086 523412 /home/pankaj/mystuff/myfile (deleted)
[root@DeathStar mystuff]# ls -l /proc/23772/fd/4
lr-x------ 1 root root 64 Jun 14 12:57 /proc/23772/fd/4 -> /home/pankaj/mystuff/myfile (deleted)
[root@DeathStar mystuff]# cp -a /proc/23772/fd/4 myfile.wrong
`/proc/23772/fd/4' -> `myfile.wrong'
[root@DeathStar mystuff]# ls -l myfile.wrong
lrwxrwxrwx 1 root root 37 Jun 14 13:00 myfile.wrong -> /home/pankaj/mystuff/myfile (deleted)
[root@DeathStar mystuff]# cp /proc/23772/fd/4 myfile.saved
`/proc/23772/fd/4' -> `myfile.saved'
[root@DeathStar mystuff]# vi myfile.saved

and here is an obvious way to know which all files you can recover!

lsof | grep deleted 

Reference:linux.com