How to Find Most Used Disk Space Directories and Files in Linux

On Linux, disk space can disappear fast. This guide shows you how to spot the biggest files and directories quickly, understand size mismatches, and free up space safely.

How Do You Check Disk Usage With Built-In Linux Tools?

In Linux Bash, you have several built-in utilities and commands that you can use to check and monitor disk usage. These utilities are readily available and don’t require any additional installations.

Here are some of the commonly used built-in utilities for checking disk usage in Linux:

How Do You Find Large Files in Linux?

Most Linux systems include the du tool. Use it to see which files and folders use the most space.

To find the top 10 largest files from the current directory, run the following command in your Linux terminal:

du . | sort -nr | head -n10

This command utilizes the du command to display disk usage, sort to sort the results in descending order, and head to display the top 10 largest files.

How Do You Check the Largest Directories in Linux?

Sometimes thousands of small files fill a disk faster than a few large ones. To list the largest directories in the current directory, you can run the following command in your terminal:

du -s * | sort -nr | head -n10

This command summarizes directory sizes, sorts them, and shows the top 10 largest directories in the current working directory.

How Do You Find Large Files With GNU Tools in Linux?

You can also use clever bash scripting with the find command to list the biggest files and directories.

Method 1 – Identify Large Files With find

The following command can be used to find and list files larger than 20,000 kilobytes (20 megabytes) in the user’s home directory (~).  It then sorts these files by size in reverse order and displays the file names along with their respective sizes:

find ~ -type f -size +20000k -exec ls -lh {} \; 2> /dev/null   | awk '{ print $NF ": " $5 }'  | sort -hrk 2,2

Here’s a step-by-step explanation of how this command works:

1. find ~ -type f -size +20000k: This part of the command initiates the search for files in the home directory (~). If you want to use a different directory, replace ~ with the path of your directory. The -type f option specifies that we are looking for regular files, and the -size +20000k option filters files larger than 20,000 kilobytes.
2. -exec ls -lh {} \;: For each file that matches the criteria, the find command executes the ls -lh command, which lists detailed information about the file. The {} placeholder is replaced with the current file’s name during execution.
3. 2> /dev/null: This part redirects any error messages (specifically, standard error) to /dev/null, effectively suppressing them. This is done to prevent error messages from being displayed in the terminal.
4. | awk '{ print $NF ": " $5 }': The awk command processes the output from the previous command. It extracts the file name (represented as $NF) and the file size (represented as $5) and prints them in the format “filename: size”.
5. | sort -hrk 2,2: The final part of the command uses sort to arrange the file entries. The options used are as follows:
   1. -h: This tells sort to perform a human-readable sort, which is useful for sizes with suffixes like “K” or “M”.
   2. -r: This specifies a reverse order sort, listing the largest files first.
   3. -k 2,2: This instructs sort to use the second field (the size) as the key for sorting.

Method 2 – List the Biggest Files in Size Order

Alternatively, you can use the following command to find and display information about the top 20 largest regular files in the user’s home directory (~). It reports the size of each file and its path, sorted in reverse order by size.

find ~ -type f -printf '%b %p\0' | sort -rzn | head -zn 20 | tr '\0' '\n'

Here’s a step-by-step explanation of how this command works:

1. find ~ -type f -printf '%b %p\0': This part of the command initiates a search for regular files (-type f) in the home directory (~). For each file found, it uses the -printf option to format the output as follows:
   1. %b: Represents the number of 512-byte blocks allocated for the file.
   2. %p: Represents the file’s path.
   3. \0: Terminates each output entry with a null character (\0). The null character is used to separate file entries, and is especially important when dealing with file paths that contain spaces or special characters.
2. | sort -rzn: The output from the find command is then piped (|) to the sort command for sorting. The following options are used with sort:
   1. -r: Performs a reverse order sort, arranging the entries from largest to smallest.
   2. -z: Informs sort that the input entries are null-terminated, which is why the null character (\0) was added at the end of each entry by the find command.
   3. -n: Specifies a numerical sort, ensuring that file sizes are sorted based on their numeric values rather than lexicographically.
3. | head -zn 20: After the sorted list is generated by sort, the output is piped to the head command.
   1. -z: Informs head that the input entries are null-terminated.
   2. -n 20: Limits the output to the first 20 entries, which are the 20 largest files based on size.
4. | tr '\0' '\n': Finally, the tr (translate) command is used to replace the null characters (\0) in the output with newline characters (\n). This is done to format the output in a more human-readable way, with each file and its size on a separate line.

Note: You can also use the above bash script in conjunction with other bash commands such as numfmt to convert file sizes into human-readable formats. For example, you can do something like this:

find ~ -type f -printf '%b %p\0' | sort -rzn | head -zn 20 | numfmt -z --from-unit=512 --to=iec | tr '\0' '\n'

How Do You Check Directory Usage in Linux?

To check how much storage memory each directory occupies, use the following commands:

cd /
du -sh * | grep G

The above command shows memory usage by directories that occupy a volume measured in Gigabytes. It helps you decide which directories or files you may want to consider for deletion or optimization.

Best Third-Party Tools for Disk Usage on Linux

In addition to built-in utilities, there are many third party tools that you can use to assess disk usage in Linux Bash.

How to Use iotop to Inspect Disk I/O

iotop shows which processes are reading and writing to disk right now. It helps you spot I/O bottlenecks and noisy neighbours.

Installation: You can use the apt package manager to install iotop-c:

sudo apt update
sudo apt install iotop-c

Usage: After installation, you can run iotop to monitor and assess disk I/O usage. The -o option sorts the output by disk read or write, and -P displays paths. The -a option shows accumulated values, which can be useful for identifying processes with high disk I/O over time.

Here’s an example of how to run iotop:    

iotop -oPa

How to Use gdu to Scan Disk Usage

gdu is a fast, terminal-based disk usage analyzer. Use it to scan a path and navigate heavy folders.

Installation: You can download the binary from its GitHub repository and follow the installation steps in the official repository. For Debian/Ubuntu systems, you can run the following command to install the gdu utility:

apt install gdu

Usage: To analyze disk usage, run gdu with the desired directory as an argument. Use arrow keys on your keyboard to navigate different folders.

How to Use dua for Disk Usage

dua helps you assess disk usage quickly and offers an interactive mode for safe cleanup.The dua command features an interactive mode in which you can explore your file system and choose to delete files and directories to free up disk space. It is designed to minimize the risk of accidental deletions by using a multi-stage process, making it safe for exploration.

Installation: Dua can be installed by using the binary release for your specific system from the Dua repository.

Usage: 

• Run dua to count the space used in the current working directory.
• Execute dua * to count the space used in all directories that are not hidden.
• To learn about additional functionality such as the aggregate feature, use the dua aggregate --help command.
• To launch into interactive mode, run dua i

How to Use godu to Analyse Disk Usage

godu identifies space-hungry files and directories with an interactive view.

Installation: godu is another Go-based disk usage tool. You can download the binary from its GitHub repository, make it executable, and move it to a directory in your PATH.

Usage: Run godu to analyze disk usage for a specific directory. Use the arrow keys on the keyboard to navigate through the file system.

How to Use ncdu to Explore Disk Usage

ncdu is a terminal disk usage explorer. It scans quickly and lets you drill down and delete from the same screen.

Installation: ncdu is an interactive disk usage analyzer that is available to most package managers. You can install it using apt on Debian-based systems:

sudo apt update
sudo apt install ncdu

Usage: Run ncdu to analyze disk usage in an interactive text-based interface:

These tools provide various ways to assess disk usage, and you can choose the one that best suits your needs and preferences. Some offer graphical interfaces, while others provide command-line-based analyses.

Why Do ls and du Show Different Sizes?

ls -l and du report different things, so sizes can look mismatched. Here’s what each one shows:

Apparent Size

This is the number of bytes that an application would read if it went from the beginning of the file to the end. It’s the “logical” size of the file. This is the value you see in the output of ls -l.

Actual Disk Usage (Blocks)

This is the amount of physical space the file actually occupies on the disk. Filesystems allocate space in fixed-size chunks called blocks (e.g., 4 Kilobytes). Even a file containing a single character will consume one full 4KB block. The du and quota commands report on this actual block usage.

This difference is most dramatically illustrated with sparse files. A sparse file is a file with “holes” where data has never been written. The filesystem is smart and does not allocate any physical disk blocks for these empty holes.

Compare Apparent vs. Actual Size on the CLI

Let’s create a 1 Gigabyte sparse file using the following command.

# Create a 1GB file instantly without writing any data to it
truncate -s 1G /tmp/sparse-file.img

Now, let’s measure it in two different ways:

Check the Apparent Size with ls:

ls -lh /tmp/sparse-file.img

The ls command reads the file’s metadata and reports its logical size: a full Gigabyte.

Check the Actual Disk Usage with du:

du -h /tmp/sparse-file.img

The du command inspects the blocks allocated by the filesystem and reports that it is using zero blocks of physical disk space.

This is an extreme example, but it perfectly illustrates that a file can appear to be very large while consuming very little of your quota. This is used heavily in virtual machine disk images, database files, and other applications that pre-allocate large files.

How Do You Find Deleted but Open Files With lsof?

In Linux, when you delete a file with rm, you are only removing its name from the directory. The actual data on the disk is not freed until every process that has the file open finally closes it. This is the most likely cause of the large discrepancy in your case.

• The du utility can’t see the file because its name is gone from the directory tree.
• However, its data blocks are still allocated to your user ID.

The lsof (List Open Files) command is the perfect tool for finding these “phantom” files.

How to Use lsof to Locate Deleted Files

To find deleted files that are still open, use lsof with the link-count filter. The output is noisy, so filter by your user.

# The +L1 flag filters for files with a link count less than 1 (i.e., deleted)
# The grep command filters this system-wide list to only show your files
lsof +L1 | grep 'runcloud'

Replace runcloud with your actual username before running the above command.

In the above example, we can clearly see that some files are still being identified by the lsof command even though they have been deleted and can not be accessed using the ls command.

How to Free Space From Deleted Files in Linux

If a deleted file is still open, stop the process holding it to release the space. Before you terminate the process, make sure you understand why it’s open.

kill <process ID>

After you run the kill command, the operating system will clean up the process, close the open file descriptor, and the filesystem will finally be able to free the data blocks. 

Linux Disk Usage Tools – At a Glance

Key Takeaways

You now know several ways to find which files and directories are using the most space in Linux — from built-in commands like du and find to interactive tools like ncdu and gdu. These methods help you act fast when disk space runs low, prevent downtime, and keep your systems healthy.

But constantly logging in and running these commands isn’t always practical. That’s where RunCloud helps.

With RunCloud, you get:

• A clear dashboard showing disk usage, CPU, and memory in real time
• Alerts before space runs out, so you can act early
• A secure, browser-based file manager to clean up files without needing command-line access

By combining Linux’s flexibility with RunCloud’s visibility, you can keep your servers lean and reliable.

Start with RunCloud today and make disk management effortless.