extundelete

Two ways to save a deleted file: pull it from /proc/PID/fd while the process is open, or carve it by signature with PhotoRec before blocks are overwritten.