Yes. On Linux/Unix you don’t delete the file, you just delete it’s name, which is merely a link to the actual file. That’s also the reason why the syscalls name is actually unlink and not delete. As soon as there’s nothing pointing to a file anymore, it is deleted.
As long as a process holds a file handle, there’s still a reference to said file, so it won’t be deleted. That saved me once, when I accidentally deleted a file I wanted to keep: As there still was some process keeping it alive, I could just go to /proc/[process id]/fd/[file descriptor id] and copy it to a safe location.
Hmm. So are the blocks freed up for overwriting on file close, then?
Yes. On Linux/Unix you don’t delete the file, you just delete it’s name, which is merely a link to the actual file. That’s also the reason why the syscalls name is actually
unlink
and notdelete
. As soon as there’s nothing pointing to a file anymore, it is deleted.As long as a process holds a file handle, there’s still a reference to said file, so it won’t be deleted. That saved me once, when I accidentally deleted a file I wanted to keep: As there still was some process keeping it alive, I could just go to
/proc/[process id]/fd/[file descriptor id]
and copy it to a safe location.