SysAdminGear

You can check this on: /proc/PID/cwd directory or you can use pwdx command to report the current working directory of a process or processes.

Using pwdx:
# pwdx 1234

Output:
1234: /folder/

Usign /proc/PID/cwd:
# nano /proc/1234/cwd

This is a good way to check if someone is running processes on hiden folders.