How can I find phantom storage usage?

Solution 1:

You can find the biggest open files with:

sudo lsof -s | awk '$5 == "REG"' | sort -n -r -k 7,7 | head -n 50

This will list the regular files (not pipes, sockets, etc) sort by size in descending order, and take the top 50.

You might also look at what processes have the most files open, with something like

sudo lsof | awk '$5 == "REG" {freq[$2]++ ; names[$2] = $1 ;} END {for (pid in freq) print freq[pid], names[pid], pid ; }' | sort -n -r -k 1,1

I'd look at sudo lsof | grep deleted

sudo lsof +L1 will show deleted files. For speed, combine this with -Pn.

e.g. lsof -Pn +L1