Ad a). The file was deleted, possibly by process 2147 itself. It's a common practice if you need a scratch file (not a log file) to create a file, get a handle to it and then delete it. A delete will remove entry in the directory in which the file was created, so it is not possible for other processes to access it. A handy scratchpad that no-one can look into. When the process closes the file and there are no more handles to it, the file system will mark blocks occupied by the scratchpad file data as unused. If it really was a log file, it could have been deleted (e.g. by accident), so the process still writes to its log, but no one else can read it (think: write only memory ;) ).
Ad b) You cannot access the contents of the file in the normal way, i.e. accessing file system in a normal way. You would have to start accessing the data below the filesystem, looking for blocks which hold scratchpad's data. If you want to try that, then mount the filesystem holding the deleted file read only as soon as you kill 2147, or you risk the data being overwriten once 2147 quits and the blocks holding its data will be marked as unused. How exactly find the data blocks you need? Sorry, cant help you there :(.