look in /proc/<pid>/fd -- the symlinks in here will continue to work until the process exits, even if they point to deleted files. hint (from a post on commandlinefu.com): find /proc/*/fd -ilname "/tmp/Flash*" or: lsof | grep Flash will tell you the PID of the process you need to look in