/proc 分区下保存着进程目录和名字，包含fd(文件描述符)和其下的子目录（进程打开文件的链接），那么如果删除了一个文件，还存在一个 inode的引用：/proc/进程号/fd/文件描述符。
步骤
1.lsof查找deleted文件的pid
[root@16-21 ~]# lsof |grep delete
tsf-agent 3265 root 8w REG 253,1 261361 1179739 /root/tsf-agent/agent/log/agent.log (deleted)
tsf-agent 3265 3266 root 8w REG 253,1 261361 1179739 /root/tsf-agent/agent/log/agent.log (deleted)
tsf-agent 3265 3267 root 8w REG 253,1 261361 1179739 /root/tsf-agent/agent/log/agent.log (deleted)
tsf-agent 3265 3390 root 8w REG 253,1 261361 1179739 /root/tsf-agent/agent/log/agent.log (deleted)
tsf-agent 3265 17882 root 8w REG 253,1 261361 1179739 /root/tsf-agent/agent/log/agent.log (deleted)
2.找到fd下的inode
[root@16-21 ~]# cd /proc/3265/fd
[root@16-21 fd]# ll
total 0
lr-x------ 1 root root 64 Mar 2 15:26 0 -> /dev/null
l-wx------ 1 root root 64 Mar 2 15:26 1 -> /root/tsf-agent/agent/log/stdout
l-wx------ 1 root root 64 Mar 2 15:26 2 -> /root/tsf-agent/agent/log/stdout
lrwx------ 1 root root 64 Mar 2 15:26 3 -> /tmp/tsf-agent.lock
lrwx------ 1 root root 64 Mar 2 15:26 4 -> anon_inode:[eventpoll]
lr-x------ 1 root root 64 Mar 2 15:26 5 -> pipe:[276440834]
l-wx------ 1 root root 64 Mar 2 15:26 6 -> pipe:[276440834]
lrwx------ 1 root root 64 Mar 2 16:05 7 -> socket:[286543417]
l-wx------ 1 root root 64 Mar 2 15:26 8 -> /root/tsf-agent/agent/log/agent.log (deleted)
3.拷贝文件出来
[root@16-21 fd]# cp 8 /tmp/aaa
[root@16-21 fd]# head -2 /tmp/aaa
2022-02-16 15:17:25.993 info core/core.go:152 [Core] agent start running
2022-02-16 15:17:25.993 info network/worker.go:50 [Network] agent networker config: {InstanceId:172.16.16.21 MasterAddress:172.16.16.33:8200}