Linux

lsof

Check which process has directory open or files within

lsof +d /var/lib/libvirt

Check recursively in directory which files are open by which process

lsof +D /var/lib/libvirt

Print bytes used by 'deleted' files.

lsof |grep deleted |awk '{s=(s+$8)} END {print s " bytes"}'

stat

stat

stat -c "%a %U:%G %n" /usr/bin/ping

boot in single user mode

at the end of the linux line in grub:

init=/bin/bash

or the following. Which will start a root shell on tty9

systemd.debug_shell