Where does the process write if the file is deleted but the descriptor is open? Can the contents be viewed?

If a file is deleted from the filesystem but a process still holds an open descriptor to that file, the process will continue to write data to the inode of that file. The file is not physically displayed in the directory, but the data is stored on disk as long as the descriptor remains open.

This is because, in Unix-like systems, deleting a file (unlink) removes the link to the file from the directory, but the file itself is only deleted when the number of links and open descriptors becomes zero.

To view the contents of such a "deleted" file, you can:

• Find the descriptor of the process that has the file open, for example, through /proc/<pid>/fd/.
• Navigate to the directory /proc/<pid>/fd/ and look at the symbolic link to the descriptor, for example, /proc/<pid>/fd/3.
• Read the contents through this descriptor, for example, cat /proc/<pid>/fd/3.

Thus, even if the file is deleted from the directory, its contents are accessible through the open descriptor until the file is closed by the process.