Why du and df Show Different Disk Usage: Linux File System Mechanics Explained

When a user asks why the results of du and df differ, the answer lies in how the Linux file system records space usage.

Typical df output

[root@xuexi ~]# df -hT
Filesystem          Type   Size  Used Avail Use% Mounted on
/dev/sda2           ext4    18G  1.7G   15G  11% /
tmpfs               tmpfs  491M     0  491M   0% /dev/shm
/dev/sda1           ext4   239M   68M  159M  30% /boot
//192.168.0.124/win cifs   381G  243G  138G  64% /mnt

Typical du output for the root directory

[root@xuexi ~]# du -sh / 2>/dev/null
244G    /

Here df reports only 1.7 GB used on /, while du reports 244 GB, a huge discrepancy.

File storage and deletion process

The file system stores a file by allocating an inode, updating the inode map, creating a directory entry that points to the inode, allocating data blocks via the block map, and finally linking those blocks to the inode.

When a file is deleted, the directory entry and inode pointers are removed, the inode is marked free in the inode map, and the data blocks are marked free in the block map. If a process still holds the file open, the data blocks remain allocated until the process releases them.

How du works

du

walks the directory tree and calls stat on every file, summing the reported sizes. It therefore counts only files that are reachable through the directory hierarchy; deleted files that are still open are invisible to du. It also traverses mounted file systems unless explicitly excluded.

How df works

df

reads each file‑system's superblock to obtain the total number of data blocks and the number of free blocks. Because this information is stored per file system, df is fast and reports space used by the entire device, regardless of mount points. It also counts blocks that belong to deleted files still referenced by running processes, since those blocks have not yet been marked free in the superblock.

Practical examples

Creating a large file, checking with du and df, then deleting the file while a process (e.g., tail -f) keeps it open shows that du reports the reduced size, whereas df still shows the original usage. Once the process exits, both commands agree again.

Tools like lsof can reveal which deleted files are still held open, helping to identify hidden space consumption.

Conclusion

Understanding the different data sources—directory traversal for du versus superblock statistics for df —explains why their outputs can diverge, especially in the presence of mounted partitions, deleted but still‑referenced files, and the way the kernel tracks block allocation.