Documenting for posterity, and in case anyone else runs into the same problem:

I ran into a situation today where df(1) showed me a filesystem that was getting pretty full (109GB used out of 146GB), but when I used du(1) to find the space hogs, it was only able to locate <30GB of data on the partition.

(Hint: it was the root partition.)

The culprit turned out to be 87GB of files "hidden" underneath mountpoints.  If you create /mnt/xyz, copy files into /mnt/xyz/*, then mount another filesystem (local or remote) at /mnt/xyz, the original files are still there, still taking up disk space, but unavailable.

Luckily, this was a Linux system, and I was able to get access to those files using a rebind mount:

- mkdir /tmp/xyz"

- "mount -o rebind /dev/mapper/root_lv /tmp/xyz"

- "cd /tmp/xyz/mnt/xyz"

- "du -sh *"

...yup, there's 87GB of files that I *don't* see under /mnt/xyz.

It's pretty obvious that the files were intended to live on a remote fileshare, but got copied in at a point in time when the remote filesystem wasn't mounted.  Now I'm mv(1)'ing 87GB of data back across to a Windows server across a CIFS mount... time to go for lunch, I guess!