Disk space remains the same pre and post file deletion. It is likely a process is still using the deleted file. To get a list of deleted files which are still marked open by processes:

lsof +L1

COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF NLINK    NODE NAME
tuned   111 root    7u   REG  202,2     4333091     0 2141 /tmp/jar_cache23323.tmp (deleted)

Simply kill the process to dump the file in question:

kill -9 111
Written by Matt Cooper
Hi, I'm Matt Cooper. I started this blog to pretty much act as a brain dump area for things I learn from day to day. You can contact me at: matt@linuxtutorial.co.uk.