In *BSD you can use fsdb to link an inode to a directory, ala:
-# fsdb /dev/ufs/foo
> inode 424242 # inode number of the target directory
> ln 821339 myimportantfile
You might also need to do "inode 821339" and "uplink" to increment the link count. Alas, you can't do this on a live filesystem, at least not safely, and once deleted the inode will be cleared, so doing this won't get your file back. Maybe if you pull the plug and try it on an unclean filesystem?
Could you not just hardlink to the /proc/<xxx>/fd/<y> file descriptor? I haven't tried this, but considering you can `cp` from the open descriptor to a new file, I should also think you could make a new hardlink to that same descriptor.
It shouldn't be too hard to come up with a kernel extension that allows you to do this - in fact I wouldn't be surprised if there already was an undocumented ioctl() that links a particular inode on a file system.
Alternatively, the sledgehammer method is hitting the power button: a fsck should be able to pick up the nonzero refcount and make it available in lost+found. (depending on the file system)
Is there some arcane unix command that allows you to do that ?
If the file is large enough there may not be enough space to do a copy, so that's why it would be nicer to actually restore that inode...
jam@jam:~$ touch z
jam@jam:~$ tail -f z
^Z
[1]+ Stopped
jam@jam:~$ rm z
jam@jam:~$ lsof | grep /home/jam/z
tail 19192 jam 3r REG 8,17 0 821339 /home/jam/z (deleted)
jam@jam:~$
The 821339 is the inode.