/ drive is suddenly 100% full...

I'm running Redhat 9 and just noticed that my / partition is completely full (on a 100G drive). Last time I checked (1 week ago?) it was only 68% full.

I have had no problems until recently when I started having a runaway imapd process that I ended up killing by rebooting the machine. After reboot I forgot to manually remount a backup drive and after a while I noticed that there was a LOT of HD activitiy and I saw that rsync was running (I have a cron job to synch to mp3 directories across 2 drives) and trying to write to the backup drive (which had been unmounted). I killed this process with 'kill.'

These are the only 'events' I know of that are out of the ordinary. I use this machine as a mail server (sendmail), very small use web server, and an mp3 and file server for my home network.

my question: can the rsync problem have written temp files somewhere? (the source directory was mounted at that time, the target drive was not). Any other reasons why 25G or so of space would disappear? what diagnostic can I run to try to find out where this space has gone?

----

update: I've used du to look at the directory sizes from the root level and they don't add up: I count approx 60GB of used space though df reports:
Filesystem Size Used Avail Use% Mounted on
/dev/hda2 113G 112G 0 100% /
/dev/hda1 99M 19M 76M 20% /boot

something is weird...

Unmount the backup drive and check the directory that you use as a mount point. When rsync was running without the drive mounted, that's where the files would have been. Since there were no existing files to compare to, rsync would populate the directory with all the files. 8)

a ha! thank you!

i always(ok, not always) wondered what would happen to a directory with files in it and you mount a partitoin over it. would this be a possible way to hide files. =)