Try running "du -s * 2>/dev/null | sort -n | tail" in the root directory and then narrowing down the possibilities from there.

"2>/dev/null" redirects error output to /dev/null instead of displaying it.