I have a file that was deleted, but is still held open by a program. I found the inode number using lsof. How can I create a hard link back to that inode?
You can't create a link to it, but you can get it back. Let's do an experiment:
myfile.txt is now gone, but the inode is kept alive by the tail command. To get your file back, first find the PID of the process keeping the inode:
The PID is 409. chdir to /proc/409/fd/ and list the contents:
The /proc/[PID]/fd/ directories contain symlinks to file descriptors of all files the process uses. In this case the symlink "3" points to the deleted file. So, to restore the file, copy the contents to a new file:
There is no portable way to do this under Linux. Best way would probably be to get all activity on the file-system to cease, kill the program that holds the file open, unmount the file system and use a file-system debugger to re-attach it to a directory. If you have the file system exported through NFS, at least some versions of NFS may allow you to read the file data across NFS.