In Linux, it is possible to delete a file that has been opened by multiple processes. If you stop one of the process and delete the file without stopping the other process, the system will still show the disk space as being used.
I recently had this happen, I had a MySQL database that was using 29GB of storage space. I stopped the database, deleted the files and recreated the database. Once complete, I noticed that I didn't reclaim any of the used space.
Using this process, I was able to determine that my anti virus software had the database file open. I restarted my AV services and suddenly I had all of my space available again.
find /proc/ -mindepth 3 -maxdepth 3 -regex '/proc/[1-9][0-9]*/fd/[1-9][0-9]*' -type l -lname '*(deleted)' -printf '%p\n %l\n' 2>/dev/null
In the above, the find is the find utility which can be used to locate just about anything you are looking for on the system.
The /proc/ is the folder where find starts its search. The -mindepth 3 -maxdepth 3 limits the search to only directories that are three levels deep under the proc folder. In this case, it will cause find to only look at the (fd) folders.
The -regex '/proc/[1-9][0-9]*/fd/[1-9][0-9]*' uses a regular expression to further limit the folders and files to only ones that contain /proc/ followed by at least 2 digits, in reality, we really only one process folders which are all digits. This is the followed by /fd/ again followed by digits.
The -type l informs find to only report on link files (link files are, generally, pointers to files, not the files themselves).
The -lname '*(deleted)' informs find that the found links can start with anything but must end with the phrase (deleted).
The -printf '%p\n %l\n' instructs find to print the found links name and the file to which it points.
The 2>/dev/null instructs the shell to send all errors from the find command to the /dev/null device. /dev/null is a device that essentially destroys anything sent to it.