On Fri, 8 Feb 2008, Mark Rogers wrote:
Oops, forgot to paste the link to the how-to: http://www.linux.com/articles/58142?tid=47
Thanks Mark. I followed the instructions linked above, but I've got a feeling all they did was save a snapshot of the file as it was when I followed the instructions, whereas what I want is a snapshot of its state just before the process that's going to write it exits. But the above URL did give me the clue that the symlink in /proc exists.
Thanks to Phil as well: time-critical unmounting of a filesystem sounds scary, but I've put a pin in it for later.
What I've done for now is written a little perl script that opens the symlink in /proc for reading, then enters an endless loop. That should preserve my data until I can open them in a text editor and copy and paste them somewhere safe, right?