$ date >foo
$ sleep 9999 <foo &
[1] 2945
$ rm foo
$
$ l /proc/2945/fd
total 0
lr-x------ 1 ralph ralph 64 2011-07-25 08:10 0 -> /home/tmp/1311577788.728092960/foo (deleted)
lrwx------ 1 ralph ralph 64 2011-07-25 08:10 1 -> /dev/pts/0
lrwx------ 1 ralph ralph 64 2011-07-25 08:10 2 -> /dev/pts/0
$
$ gdb --pid 2945
(gdb) print lseek(0, 0, 0)
$1 = 0
(gdb) print malloc(1024)
$2 = (void *) 0x1410030
(gdb) print read(0, 0x1410030, 1024)
$3 = 30
...
(gdb) print creat("/tmp/recover", 0666)
$8 = 3
(gdb) print write(3, 0x1410030, 30)
$9 = 30
(gdb) print close(3)
$10 = 0
(gdb) quit
$
$ cat /tmp/recover
2011-07-25 08:09:53 +0100 Mon
$