Undelete Still Open Files on ext2/3/4

As mentioned by Ted on linux-ext4 mailing list, there are some ways to get your files back if it is still open:

Some background:
On ext3/4, once deleted, the inode will be put to orphaned inode list. On recovery,on recovery this orphan list is traversed and iput will be called on each of the inodes to mark them as free.

So, theoretically, we have out first solution:
1. provoke a crash and manually remove the inode from the orphan list, then mount the partition as ext3.

But another simple solution exists:
2. kill -STOP the process that owns the file, copy it via “cat /proc/$pid/fd/$fd > rescue-file”. and then kill -9 the process if you don’t want it to make any further changes.