Patrick O'Callaghan wrote:
The upshot is that if a process has a file open, and that file is
replaced by a different one (using unlink and creat) then the process
will continue to use the old file and all its attributes. When the
process closes the file, or terminates, the reference disappears and the
system then recovers the space.
I make use of this when I save youtube movies. Flash deletes the file as soon
as it is downloaded, but as long as the flash/nspluginwrapper processes are
still running, the deleted file can be captured and copied to another location.