Causes of filesystem usage discrepancies

Q: Why do tools such as du and df report different amounts of used space?

A: Possible causes of discrepancies, listed in rough order of probability:


 * 1) Files have been deleted but are still opened by some process
 * 2) Using du without the --one-file-system option, so you end up including the contents of subdirectories that are mount points
 * 3) Files have been removed or reduced in size and the super block has not been updated: you can force an update using the sync command and examine what files are being modified using the LiSt Open Files utility
 * 4) Lost blocks on a damaged file system: use fsck to find and repair the damage
 * 5) Files hidden to the reporting utilities; e.g.: files in a directory that has been covered by a mount-point: try unmounting everything but the filesystem in question and examining the mount stubs
 * 6) Journals on a journaling filesystem such as Ext3 or ReiserFS: the standard utilities for each filesystem should include a tool that displays journal information; e.g.: `debugreiserfs &lt;device&gt;` reports the number of blocks occupied by a ReiserFS journal on &lt;device&gt;
 * 7) Files hidden for nefarious purposes such as by a Rootkit