Both can be correct. du only shows files in directories. If a file is
open but deleted it will not exist in any directory but will be taking
up space. If the program that opened the file is still writing, it
will be gradually taking up more space.
This command will list all open descriptors on /dev/hda2. Any numbers
without a name indicate files that are open but are not in directories.
ls -l /proc/*/{fd,cwd,exe,root} | \
fgrep '[0302]' | \
sed -e 's/.*://' | \
sort -u | \
awk '{print "echo " $1 "; find / -xdev -inum " $1 " -print"}' | \
sh