df is a great tool for checking the amount of free space on a disk (and the amount that’s taken). df has a number of options for ways to view the output and can even look at free iNodes and blocks rather than just showing free space. However, df is going to come up short if you’re hunting for where all your free space went within a given volume.
For this, look to du. du is a great tool for checking disk utilization at more of a directory level. For example, the following command will show you how much space is being taken up by each application in the the /Applications directory:
du -d 1 /Applications/
Now run the command without the -d 1:
du /Applications/
The -d flag limits the depth that the command will traverse. By specifying 0 you would only see the files of a given directory, whereas if you specify -d 2 then you will be shown the sizes of your child directories from the path you specified and their children (since that’s two). You can go as deep as you want with the depth setting, but the data returned by the command can be too much, at times. Also, the longer it will take for the command to complete as it’s calculating more and more data.
Some other flags that are useful are -x and -H. These will traverse mount points and symbolic links, respectively (both of which are not followed by default). This can help to keep your command’s output limited to the host and volume of directories underneath the specified parent directory.
If you’re interested in seeing way to much information, try just running:
du -a
If you suddenly have only 1k of free space available, a series of du commands can turn information about where all of your data is in no time.