Who stole my disk space ?
In my Cube running 10.3.9 I have a 19 GB harddisk. It's currently 98% full with 18.6 GB occupied.
oswald:/usr/bin root# df -k Filesystem 1K-blocks Used Avail Capacity Mounted on /dev/disk0s3 19908432 19276288 433060 98% /
but when I run du -sh on / (as root) to check where the space is used
du -sh | Name | Finder Information |
---|---|---|
8.8G | Users | 8.82 GB |
1.1G | System | 1.06 GB |
745M | usr | |
480M | Library | 371 MB |
301M | Applications | 300 MB |
141M | private | |
82M | Developer | |
3.7M | mach_kernel | |
some more small stuff |
all this adds up to approximately 12GB. So where is the rest ?
Peculiarily the Finder and du differ by 110 MB on my Library folder. Is this because the other files are owned by other users ?
It could be that after deleting a ZIP file of a mere 6 GB, using
the Finder, something might have broke inside HFS+. Or maybe the
log of the journalling filesystem was not properly cleaned up
?
Another possibility is, that my box has been opened up and that a
root kit was installed. But when I looked at the WeaponX
source code, I thought, it should be fairly easy to trick a root
kit, based on that code, to reveal itself. I tried, but I didn't
find anything.
Solution ? I rebooted. Mac OS X cleaned itself up, I suspect it was the log:
oswald:~ nat$ df Filesystem 512-blocks Used Avail Capacity Mounted on /dev/disk0s3 39816864 25264232 14154464 64% /