I started a program on a directory but accidentally removed it, and the program inside. The program generates a couple of output files. The program is still running. I wonder if I create the same directory the program will still create the output files there. Is that possible?
Once the entries for the files have been removed from the fiesystem, they cannot be recreated. If you create a new directory with the name of the old directory, it's just that: a new directory. The files don't magically appear again.
Unix (including linux) filesystems work by having inodes that contain all the information about a file, except its name. In directories entries are made with a name and an inode number, this is the only coupling of the name with its contents. It's possible to create another link to the file using
ln, with a completely different filename.
When a file is deleted, its reference count is reduced. Once that reaches zero, the file is actually deleted (the space it takes up is returned to the free block pool, and the inode is cleared). However, as long as a process still has the file open, the reference count doesn't reach zero, the file is still in existence.
Linux makes the files opened by a process available through the
/proc/ pseudo filesystem. If you know the process ID (pid) of the process, look in /proc/pid/fd/ for a list of files opened. E.g. for an
apache process, here's an abbreviated list:
$ sudo ls -l /proc/32704/fd total 0 lr-x------ 1 root root 64 Nov 20 02:39 0 -> /dev/null l-wx------ 1 root root 64 Nov 20 02:39 1 -> /dev/null lr-x------ 1 root root 64 Nov 20 02:39 10 -> /dev/random lrwx------ 1 root root 64 Nov 20 02:39 11 -> /tmp/.ZendSem.6DE1g1 (deleted) lrwx------ 1 root root 64 Nov 20 02:39 12 -> anon_inode:[eventpoll] l-wx------ 1 root root 64 Nov 20 02:39 2 -> /var/log/apache2/error.log
Note the line with
(deleted) appended to it. Apache uses that for a temporary file that can't be accessed by others: it creates and opens the file, and then unlinks (removed) it. However it can still use it, and apache's child processes can also use it as they inherit open files.
In your case you should also be able to find the deleted files. Via the /proc entries you can copy the "deleted" files to somewhere safe as long as the process is running:
sudo cp /proc/pid/fd/x $HOME/somewheresafe/filename