What happens to the files that are deleted while they have a file handle open to them?
I have been wondering this ever since I figured out I could delete a video file while it was playing in MPlayer and it would still play through to the end. Where is it pulling the data from? Is it still coming from the hard drive? Did it get copied to RAM once I deleted the file?
If it's still on the hard drive, what happens if I fill up the file system while the program is running reading from what is essentially unallocated space? If it's buffered in RAM, what happens if I flush the buffers?
What happens if the file was on an NFS share–is it stored on the server? (Isn't that a security risk–DoS by tons of open remote file handles?)
Doing an lsof -n |grep '(deleted)'
sometimes yields interesting results; if I'm upgrading packages that swap out shared library files, then running programs that had been using those libraries will still be able to use them as if nothing changed.
Bonus question: Is there some way to get the data back from the dead in this situation?