Thanks Pludi, that does sound very reasonable. If it happens again I'll let you know so we can prove your thoughts on this. The user that owned the file did not have any processes running and I was not able to track the PID and PPID associations back to anything that caught my eye. Thanks for reminding me of lsof and fuser. I have heard of those commands, but, unfortunately, have not gotten into the habit of using them. My bad. I'll start that today.