This page lists various hints about deleted files.

Package upgrade

After a package is upgraded, only services (in /etc/init.d) are restarted. If a program from that package was running during the upgrade, some "traces" will remain after upgrade:

  1. The old version of the program will keep running, as long as it isn't restarted.

  2. The disk space is still used (even though the files were deleted), until the process is stopped.

The tool checkrestart(1) (from package debian-goodies) can list such programs.

Deleted, but opened file

It is possible to delete a file that is currently opened by another process. The disk space will not be reclaimed immediately... actually, the "file" could keep growing. This behavior is by designed. Actually, this is the reason why the C function call is named unlink(2) rather that delete! 

while sleep 1 ; do date ; done > /tmp/Bzzz &
tail -f /tmp/Bzzz

This script print the current date every second.

Then, you can switch to another terminal, then delete the file: 

rm /tmp/Bzzz

As you can notice, the files keeps growing, since the tail keeps printing new lines!

Now...

How how to recover a deleted opened file ?

If you need to undelete an "opened file", you can use this hint (thanks to Mike Hommey for the hint):

Assuming the running process, which opened the file, has PID=2164: 

ls -al /proc/1264/fd
total 0
dr-x------. 2 fpiat fpiat  0 2009-06-30 23:42 .
dr-xr-xr-x. 7 fpiat fpiat  0 2009-06-30 23:42 ..
lrwx------. 1 fpiat fpiat 64 2009-06-30 23:42 0 -> /dev/pts/1
l-wx------. 1 fpiat fpiat 64 2009-06-30 23:42 1 -> /tmp/Bzzz (deleted)
lrwx------. 1 fpiat fpiat 64 2009-06-30 23:42 2 -> /dev/pts/1
lrwx------. 1 fpiat fpiat 64 2009-06-30 23:42 255 -> /dev/pts/1

You can retrieve the deleted file's inode number, using lsof(8) (from lsof) 

lsof -p 1264 | grep "/tmp/Bzzz"
COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
bash    1264 john    1w   REG  254,4    16200 393313 /tmp/Bzzz (deleted)

You can finally use debugfs(8) to cat/dump/ln that file.