Let's suppose we have accidentally deleted the 1.mp3 file which is still being played in mplayer.
We look for PID of mplayer
ps -auxwww|grep mplayer
gosha 17314 3.2 0.4 38680 8908 pts/3 SL+ 00:45 0:00 mplayer 1.mp3
We go to the /proc directory with the process parameters of 17314:
The open file descriptors are listed in the fd directory (/proc/17314/fd).
In the output we see the descriptor #4 flagged as deleted.
lr-x------ 1 gosha gosha 64 2009-02-27 00:48 4 -> /home/gosha/1.mp3 (deleted)
We copy it and get the recovered file:
cp 4 /home/gosha/1.mp3