"James Webster" <James3838@tsi-net.com> writes:
> Since df reports the correct number after rebooting, I'd tend to think that
> it is a file that was opened by a process, and then deleted(my original
> suspicion).
> 
> Is there a method of determining which process it may be?

Not easily. However, you can pretty easily figure it out if you can
afford to nuke the machine. Just kill processes one by one until df
goes down.

Perry