Fun with /proc


 # ls -l /proc/PID/fd/5
 l-wx------    1 bad  guy    64 Apr 24 21:02 5 -> /tmp/tmpfg3RD3J (deleted)
 # cp /proc/PID/fd/5 /tmp/file    # get a copy, even though it's deleted

 # ls -l /proc/PID/exe
 l-wx------    1 bad  guy    64 Apr 24 21:02 exe -> /tmp/.secret/prog (deleted)
 # cp /proc/PID/exe /tmp/recovered_prog