In DistroWatch, in Questions and Answers, there is described a mechansim for recovering an open file. Several new (to me) commands are introduced:
Find pid of a process:
# pgrep firefox 30421
Look at the files in use by the process:
# ls -l /proc/30421/fd total 0 lr-x------ 1 rpb rpb 64 Jan 27 12:52 0 -> pipe:[4807933] l-wx------ 1 rpb rpb 64 Jan 27 12:52 1 -> /home/rpb/.xsession-errors lrwx------ 1 rpb rpb 64 Jan 27 12:52 10 -> socket:[4805593] ... more and more ...
It is possible to then make a copy of any file in the list by using the numeric fd:
cp /proc/30421/fd/1 ~/recovered.file