My article on recovering open but unlinked file data now at the SANS Forensics Blog: http://is.gd/hpaZ