linux中通过lsof恢复删除的文件，前题是fd被占用。

http://www.serverwatch.com/tutorials/article.php/3822816/Recovering-Deleted-Files-With-lsof.htm

One of the more neat things you can do with the versatile utility lsof is use it to recover a file you've just accidentally deleted.

Tip of the Trade: Accidentally deleted files are easily recovered with lsof.

A file in Linux is a pointer to an inode, which contains the file data (permissions, owner and where its actual content lives on the disk). Deleting the file removes the link, but not the inode itself – if another process has it open, the inode isn't released for writing until that process is done with it.

Recent Tips
» The Various bash Prompts
» Disk Encryption With TrueCrypt
» Protecting Your Root Password

Read All Tips of the Trade

To try this out, create a test text file, save it and then type less
test.txt. Open another terminal window, and type rm
testing.txt. If you try ls testing.txt you'll get an
error message. But! less still has a reference to the file. So:

> lsof | grep testing.txt
less	4607	juliet  4r  REG 254,4   21
           8880214 /home/juliet/testing.txt (deleted)

The important columns are the second one, which gives you the PID of the process that has the file open (4607), and the fourth one, which gives you the file descriptor (4). Now, we go look in /proc, where there will still be a reference to the inode, from which you can copy the file back out:

> ls -l /proc/4607/fd/4
lr-x------ 1 juliet juliet 64 Apr  7 03:19
             /proc/4607/fd/4 -> /home/juliet/testing.txt (deleted)
> cp /proc/4607/fd/4 testing.txt.bk

Note: don't use the -a flag with cp, as this will copy the (broken) symbolic link, rather than the actual file contents.

Now check the file to make sure you've got what you think you have, and you're done!