Q: 'df' reports partition is full but 'du' shows not full partition -- how to find where the problem

[Snow Leopard <snow.leopard.deb@gmail.com>]

Hello,

what would be a best approach for the following situation:

You have a web server and monitoring system reports that you short on 
disk space. You login into web server computer and command 'df' indeed 
shows that some partition is almost full.

How would you resolve the issue if 'du' does not confirm that disk is full.
You 'du' all directories in the root of the partition but sum does not 
adds up to match 'Use%' reported by 'df'.

For such situation I would assume that some process holds huge open file 
which was deleted (for example your web server was compromised).

Question: how would you find the process which holds 'deleted' file?

Thanks,
Andy