no problem. asking is what is important in times like these!

What they would be doing is using /proc/fs info, or output from lsof to display inode info of open files.

Once closed there is no info left in /proc to relink them. A proper filesystem literally clears (wipes) the inode when it is freed, so the starting point would be blank.

I am not saying it cannot be done, but it would require a set of programs that were able to read the raw filesystem, and some assistance from a knowledgeable 'agent' to put humpty dumpty back together again.

I don't know of a way. I would be surprised if there was one.

AFAIK: The only time a file link (i.e. the inode) is not cleared immediately on any UNIX system is when the file is still open. Using a dup() call it might be possible to copy the file (giving it a new name and inode), but if it is closed, the inode is cleared and the metadata (inode and directory information, and by extension any /proc info) is removed from the system.