Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Deleting files using Terminal

A user meant to take a screenshot but instead took a movie and did not shut it off. 24 hours later, the movie file was 270gb and the imac produced some error messages that it couldn't save data and mail stopped working.

I booted into Terminal, found the file, use 'rm' to delete it, verified through 'ls -al' that the file was gone, and rebooted.

The imac wouldn't reboot.

I went back into Terminal, used 'df' saw that the drive was still at 98% full.

I looked in the .Trash and the large file was not there.

I can't find the file on the machine.

I searched the machine for all files larger than 1GB, and it's not in the list.


Is there some sort of cache or shadow copy of a file removed using 'rm' on a mac?


I've since deleted other large files and directories and those also don't seem to affect the 98% full result that shows up using df.


Any ideas?

iMac Pro

Posted on Oct 13, 2021 6:54 AM

Reply
Question marked as Best reply

Posted on Oct 15, 2021 11:36 AM

The "rm" command removes the file immediately if successful. FYI, try deleting the APFS snapshots. If this large file existed when a backup snapshot was taken, then the large file you deleted may still reside in the APFS snapshot which is waiting to be transferred to your backup drive. Here is an article with details although you will need to modify the examples appropriately if you are booted into Recovery Mode (may even need to temporarily disable SIP):

https://derflounder.wordpress.com/2018/04/07/reclaiming-drive-space-by-thinning-apple-file-system-snapshot-backups/


If you are booted into Single User Mode or Recovery Mode, then "sudo" is not needed since you are already at the root prompt.


If you are booted into Recovery Mode, then using "~" for the path won't give the results you are looking for.


As for the "command not found", if you are booted into Recovery Mode, then that command may not be available from the virtual recovery mode volume. You would need to provide the full path to the "du" command which resides on the macOS system volume instead which you will need to locate. Recovery Mode has only a very small amount of utilities available.



Similar questions

10 replies
Question marked as Best reply

Oct 15, 2021 11:36 AM in response to hipcan

The "rm" command removes the file immediately if successful. FYI, try deleting the APFS snapshots. If this large file existed when a backup snapshot was taken, then the large file you deleted may still reside in the APFS snapshot which is waiting to be transferred to your backup drive. Here is an article with details although you will need to modify the examples appropriately if you are booted into Recovery Mode (may even need to temporarily disable SIP):

https://derflounder.wordpress.com/2018/04/07/reclaiming-drive-space-by-thinning-apple-file-system-snapshot-backups/


If you are booted into Single User Mode or Recovery Mode, then "sudo" is not needed since you are already at the root prompt.


If you are booted into Recovery Mode, then using "~" for the path won't give the results you are looking for.


As for the "command not found", if you are booted into Recovery Mode, then that command may not be available from the virtual recovery mode volume. You would need to provide the full path to the "du" command which resides on the macOS system volume instead which you will need to locate. Recovery Mode has only a very small amount of utilities available.



Oct 13, 2021 7:29 AM in response to hipcan

See if you can boot into safe mode and then try to Optimize storage space on your Mac - Apple Support.


How to use safe mode on your Mac - Apple Support

NoteSafe mode prevents your Mac from loading certain software as it starts up, including login items, system extensions not required by macOS, and fonts not installed by macOS. It also does a basic check of your startup disk, similar to using First Aid in Disk Utility. And it deletes some system caches, including font caches and the kernel cache, which are automatically created again as needed.

Oct 13, 2021 7:43 AM in response to hipcan

hipcan wrote:

A user meant to take a screenshot but instead took a movie and did not shut it off. 24 hours later, the movie file was 270gb and the imac produced some error messages that it couldn't save data and mail stopped working.
I booted into Terminal, found the file, use 'rm' to delete it, verified through 'ls -al' that the file was gone, and rebooted.
The imac wouldn't reboot.
I went back into Terminal, used 'df' saw that the drive was still at 98% full.
I looked in the .Trash and the large file was not there.
I can't find the file on the machine.
I searched the machine for all files larger than 1GB, and it's not in the list.

Is there some sort of cache or shadow copy of a file removed using 'rm' on a mac?

I've since deleted other large files and directories and those also don't seem to affect the 98% full result that shows up using df.

Any ideas?



list the items in the home folder with the sizes, including invisible items, copy & paste:

sudo du -h -d 1 ~/

Oct 18, 2021 5:39 AM in response to HWTech

Ultimately this is what happened - snapshots were still holding versions of the gigantic file and I couldn't 'see' them.


This was accidentally fixed when I used a different SSD to create new timemachine backups. The 'old' snapshots were gone and new ones with the lower drive space on them were in their place. This was sort of hands off - the machine sat over the weekend and fixed itself.


But thank you for these tips, the APFS and SIP info was very helpful.

Deleting files using Terminal

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.