We have hopefully managed to recover a file (or two) today from an existing process in which the files live in /tmp/, but if the process goes on too long, get deleted by the system
Find relevant Process ID >ps aux or top >pstree -pWork out files which have handles but are deleted >lsof -p bwa 22039 srpipe 4r REG 104,7 424718660 67171651 /tmp/iFCyWKyDjR/1.sai (deleted) bwa 22039 srpipe 5r REG 104,7 401682372 67171652 /tmp/iFCyWKyDjR/2.sai (deleted) Rebuild files >mkdir /tmp/iFCyWKyDjR >cat /proc/22039/fd/4 > /tmp/iFCyWKyDjR/1.sai >cat /proc/22039/fd/5 > /tmp/iFCyWKyDjR/2.sai Check >ls -lh /tmp/iFCyWKyDjR total 789M -rw-rw-r-- 1 srpipe solexa 406M 2011-09-02 09:30 1.sai -rw-rw-r-- 1 srpipe solexa 384M 2011-09-02 09:30 2.sai