> > # du -sh /* Use 'du -xh --max-depth=1 /' it will clean up your output and show you only things on the root partition. And as someone else said, deleted but open files are not removed until the file handle is closed. This is used by some applications to "hide" totally temporary files. Do 'lsof | grep delete' to see such files. (This technique is also used by malware to hide their files.) P.