Causes of filesystem usage discrepancies

Q: Why do tools such as du and df report different amounts of used space?

A: Possible causes of discrepancies, listed in rough order of probability:

1. Files have been deleted but are still opened by some process
2. Using du without the --one-file-system option, so you end up including the contents of subdirectories that are mount points
3. Files have been removed or reduced in size and the super block has not been updated: you can force an update using the sync command and examine what files are being modified using the LiSt Open Files utility
4. Lost blocks on a damaged file system: use fsck to find and repair the damage
5. Files hidden to the reporting utilities; e.g.: files in a directory that has been covered by a mount-point: try unmounting everything but the filesystem in question and examining the mount stubs
6. Journals on a journaling filesystem such as Ext3 or ReiserFS: the standard utilities for each filesystem should include a tool that displays journal information; e.g.: `debugreiserfs <device>` reports the number of blocks occupied by a ReiserFS journal on <device>
7. Files hidden for nefarious purposes such as by a Rootkit