unlinked files generally occur one of two ways:
- unnamed temporaries
- a file has been deleted, but its file descriptor is still held open.
I recently encountered a situation where tmpfs got filled up by a logfile, and then removing the logfile did not actually free up any space, because the program was still holding the fd of the logfile.
These files are not seen by programs like du, however, df is able to see the total amount of space used on a drive, including unlinked files, so simple subtraction could be used to see how much of the disk is taken up by unlinked files.