Moving a File While It's In Use -- How Does it work?

The directory entry is just a pointer to an inode. The inode contains the meta-information about the file (other than the name), and pointers to the file's data (if any). When you start to copy a file you get a handle to the inode.

The operating system maintains a count of references to the inode. As long as there are references to the inode, the inode and the file's data are kept. Once all references to the the inode are removed, the inode is and the space required by the file is released.

As you have the file open for copying it will be kept until your process closes the file. This should occur when the file transfer finishes, and will happen if the copy process fails. If the file transfer fails part way through and you have deleted all hard links to the file, you will be unable to successfully restart the transfer.

EDIT: As other have noted, file moves on the same device are done without moving the data. Instead a new directory entry is created in the destination directory, and the original directory entry is removed.

It is possible to have multiple directory entries for the same file. These are called hard links. They are created by making a new directory entry for the file without removing the original entry. The file system's inode has a reference count to record the number of directory entries pointing to the file.

EDIT2: If the process crashes or is killed, the file will be cleanly removed as the in memory access count will be reduced to zero. This is the action that occurs when the the program ends normally.

In the case of a power fail or other unorderly system shutdown, the disk will need an fsck (file system check) before it can be fully mounted. Depending on the state of the on-disk inode and directory structures, the space will be recovered, the file will remain in the directory, or a new entry will be made in the lost+found directory. The results will depend on which changes have been flushed to disk or written to the file systems journal.

As explained by Matt Jenkins, the OS (the filesystem) keeps track of files that are kept open by applications. As long as a process keeps a file open, its data stays on disk (even though it has been deleted and is no longer visible or accessible to other programs.

Note that a consequence of this is that the space occupied by a file can only be reclaimed once the last process using it has closed it. That's a FAQ for Linux/Unix file system operations: "'df' command says partition is full, while 'du' reports free space" (see e.g. http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html ). If you need to free up space, it's not enough to delete big files (e.g. logfiles), you must also make sure no process keeps them open (typically a problem with logfiles).

It's quite simple actually. The file maintains a list of references - processes that are accessing the file. When you delete the file it just removes the listing from the directory but not the file itself. The programs that still have the file open can still access it. The file is only actually deleted when all the programs that are accessing it close it.

Also, with moving the file - if it's within the same filesystem - the file doesn't actually move as such, it just changes the pointer to the directory the file is in.