There are times when the output of df will not match with that of du, this may be due to several factors. Files are held by active processes, a directory has been mounted over another.

To understand this behavior we must take into account the functioning of each of the tools:

• df –> Consults the superblock main file system, if this info is incorrect df will show incorrect data. If an fsck has been performed and not restarted, the data may be incorrect.
• du –> Goes through directories looking for files and adding up the consumed space, it can see the same as an ls.

NOTE: If a file is being used by a process and is deleted, du will not detect it since it does not exist on the disk, but df will consult the file system info, as the process is using this space it has not been marked as free (the corresponding entry in the inode table has not been deleted).

To find the responsible processes we can run:

Whoever says echo $PID says kill -9 $PID, hahaha

Another possible problem is to mount a device in a directory with data, du will only see what is above while df will see all the data, to solve this problem we can use the following “trick”:

ls: cannot access /mnt/aux/aaa: No such file or directory

Now we only see the contents of sda1.

-rw-r--r-- 1 root root 0 sep 20 22:22 /mnt/aux2/mnt/aux/aaa

“If we do a du on /mnt/aux2/, we can see what’s in the file system below ;)”