Classically, files don't get de-allocated (their blocks re-added to the filesystem free list) until the last open reference to their inode is removed, even if the file name is removed from all directories.

This behavior is commonly used for temporary files: open(2) with O_CREAT and unlink(2), and file disappears when the file descriptor is finally closed or the process exits without explicitly closing the descriptor (the kernel will close all descriptors associated with an exiting process).

Where process accounting is concerned, the kernel itself holds the inode reference until it is explictly told to turn off process accounting. See acct(2).

        Erik Fair