Big discrepancy between `du` and `df` used space on USB drive

[Adam Funk]

On 2023-01-02, Robert Heller wrote:

> At Mon, 02 Jan 2023 16:09:57 +0000 "Adam Funk" <ubuntu-users at lists.ubuntu.com> wrote:
>
>> 
>> Hi,
>> 
>> I'm trying to figure out why the card on a bike camera is fuller than
>> the files on it. Can anyone explain this?
>> 
>> /media/adam$ df -h HANDLEBAR/
>> Filesystem      Size  Used Avail Use% Mounted on
>> /dev/sda1        29G   12G   18G  39% /media/adam/HANDLEBAR
>> 
>> /media/adam$ du -sh HANDLEBAR/
>> 3.3G	HANDLEBAR/
>> 
>> The second one matches the result of adding up the files and `du`s of
>> subdirectories in that directory (including one hidden file of
>> 117K). The camera has a micro SD card with a vfat filesystem.
>
> There are "unnamed" or "hidden" files on the micro SD card.  Or files were 
> deleted, but the space that they used was not returned to the free list.  I'm 

I think that was it. I remembered that you can fsck a vfat filesystem,
and it did this:

$ sudo fsck.vfat /dev/sda1 
fsck.fat 4.2 (2021-01-31)
...
Reclaimed 253715 unused clusters (8313733120 bytes).
Dirty bit is set. Fs was not properly unmounted and some data may be corrupt.
...
*** Filesystem was changed ***
The changes have not yet been written, you can still choose to leave the
filesystem unmodified:
1) Write changes
2) Leave filesystem unchanged
[12?q]? 1
/dev/sda1: 33 files, 106975/946304 clusters

and now I'm getting consistent `du` and `dh` results for it. That
number of bytes accounts for the difference.

Thanks!







> guessing that this might happen if the file system was not cleanly unmounted, 
> eg you pulled it out of the camera while the camera was on.
>
> Or you deleted a file that was open and in use by some running process and 
> that running process is still running.  Use lsof to find that process and stop 
> it.