We had a system utility/daemon that was unlinking a file and keeping
it open in /tmp. It took months to find out why we never had any
space in /tmp. Were we able to get a list of the deleted files, we
would have known exactly where the problem was.
Also, it doesn't have to be daemones, etc that do this unlinking.
emacs will do it from time to time, as will other programs.
I used TOPS-20 years ago, and the undelete command was *VERY* useful
there. It saved my bacon many times, and just just from the
accidental rm * (well DELETE *.*.*).
Warner
P.S. I'm not saying that this is worth it 100%. I'm just saying that
if you want a proper undelete facility, you must implement it in the
kernel.