Sometimes people delete files they shouldn't, a long-running process still has the file open, and recovering the
data by catting /proc/<pid>/fd/N just isn't awesome enough. Awesome enough would be if you could "undo" the delete by running some magic option to ln that would let you re-link to the inode number (recovered through lsof).
I can't find any Linux tools to do this, least with cursory Googling.
What do you got, serverfault?
EDIT1: The reason catting the file from /proc/<pid>/fd/N isn't awesome enough is because the process which still has the file open is still writing to it. A delete removes the reference to the inode from the filesystem namespace. What I want is a way of re-creating the reference.
EDIT2: 'debugfs ln' works but the risk is too high since it frobs raw filesystem
data. The recovered file is also crazy inconsistent. The link count is zero and I can't add links to it. I'm worse off this way since I can just use /proc/<pid>/fd/N to access the
data without corrupting my fs.
