On Linux you can unlink open files even on a FAT formatted partition (I just tried it with busybox). It's actually quite intriguing how this works. When you d

On Linux you can unlink open files even on a FAT formatted partition (I just tried it with busybox). It's actually quite intriguing how this works. When you delete a file on FAT it seems to remove the directory entry, but does not update the free space information and doesn't free the clusters. If you run a fsck.fat on a filesystem in this state, it frees up the space (likewise, if you just let the process exit and unmount the disk normally, this space is also freed). Presumably the information about where the file exists is only kept in RAM once you delete the directory entry. This should be sufficient to let anyone with an open file handle etc to keep reading it (including the kernel reading additional pages of the executable).