lsof | grep deleted which is process name code example Example: linux process holding deleted file lsof -a +L1 *mountpoint*