Disk usage discrepancy?

Did you enable the scan on startup before restart the node?
You may track the filewalker with these scripts: