1) find the process+fd by looking directly in /proc:
ls -al /proc/*/fd/* 2>/dev/null | grep {filename}
2) Then a similar technique to @nickray's, with pv
thrown in:
tail -c +0 -f /proc/{procnum}/fd/{fdnum} | pv -s {expectedsize} > {recovery_filename}
You may need to Ctrl-C when done (ls
/proc/{procnum}/fd/{fdnum}
will tell you that the file
no longer exists)), but if you know the exact size in bytes, you
can use pv -S
to make it exit when the count is
reached.