Find deleted files that still consume disk space
Build a paste-ready command, then review its compatibility and effects before running it.
sudo lsof -nP +L1 | sort -k7 -nr | head -<count>Complete required fields to copy the generated command.
cautionrequires privileges Compatibility
Linux + macOSVerified for Linux, macOS using bash, zsh syntax.
Operational knowledgereview due 2027-01-19
Requirementslsoflsof must be installed and available on PATH.Elevated accessReview the exact scope before using an elevated account.
Version supportlsof Current supported releasesVerified for linux, macos using bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalsjava 3112 app 17w REG 253,0 4294967296 0 12881 /var/log/app.log (deleted)Representative successful output; values vary with the selected target and system state.
Known errorslsof: command not foundlsof is missing or is not available on PATH.Permission deniedThe current identity does not have the required access.
Verifysudo lsof -nP +L1 | sort -k7 -nr | head -{{count}}Re-run the corresponding read-only inspection and confirm the intended state.Rollback noteNo universal automatic rollback is available. Capture the current state and use the tool-specific recovery procedure before applying changes.
Command breakdown
01sudoPrivilege elevationRuns the following command with elevated privileges after authorization.
02lsofCommandRuns the lsof stage of this one-liner.
03-nPOptionConfigures lsof with the -nP option.
04+L1OptionConfigures lsof with the +L1 option.
05|PipelinePasses the output on the left to the command on the right.
06sortCommandRuns the sort stage of this one-liner.
07-k7OptionConfigures sort with the -k7 option.
08-nrOptionConfigures sort with the -nr option.
09|PipelinePasses the output on the left to the command on the right.
10headCommandRuns the head stage of this one-liner.
11-<count>OptionConfigures head with the -<count> option.
This advanced community-curated one-liner combines several stages. Review every option and placeholder before running it.
Example input
sudo lsof -nP +L1 | sort -k7 -nr | head -5
Example output
java 3112 app 17w REG 253,0 4294967296 0 12881 /var/log/app.log (deleted)
node 8421 app 9w REG 253,0 734003200 0 9912 /var/log/api.log.1 (deleted)
Illustrative output — exact values vary by system and data.
Official sources