When a process opens a file and then unlinks it, the file’s resources remain in use by the process, but the file’s directory entries are removed. Hence, even when you know the directory where the file once resided, you can’t detect it with ls.
This can be an administrative problem when the unlinked file is large, and the process that holds it open continues to write to it. Only when the process closes the file will its resources, particularly disk space, be released.
Lsof can help you find unlinked files on local disks. It has an option, +L, that will list the link counts of open files. That helps because an unlinked file on a local disk has a zero link count. Note: this is NOT true for NFS files, accessed from a remote server.
Use the option to list all files and look for a zero link count in the NLINK column
<strong>COMMAND PID USER FD TYPEDEVICE SIZE/OFF NLINKNODENAME