MacBook Air M3: System Data fills SSD after deleting files

What information do you get when you click on the "hidden space" piece? Have you granted DaisyDisk full disk access in System Settings?

Here is what DaisyDisk says about "hidden space:"

The following items typically contribute to the hidden space:

• purgeable space (covered in a separate article) — mostly local snapshots of Time Machine, and also swap files, sleep images and other temporary system files.
• other volumes (covered in a separate article) — sub-volumes within the same physical disk that share its pool of free space (a new feature of APFS). This item may include some invisible system volumes and the volumes you created yourself.
• still hidden — the ultimate remainder of unaccounted space, usually consists of:
  • Home folders of other users on the same Mac, if any
  • System stuff, like Spotlight index, document versions, etc.
  • File system overhead (2-3 GB is normal for the startup disk)
  • Space missing due to file system errors

How to reveal the hidden space

• macOS Mojave or later: Make sure your grant DaisyDisk the full disk access, then relaunch DaisyDisk and rescan your disk.
• Use the scan as administrator command. The hidden space should disappear, or become significantly smaller by size. And in reverse, some other folders will grow in size correspondingly, and restricted files and folders will become visible here and there on your disk.
• Note that some small amount of hidden space (a few GB) may still remain even after scanning as administrator. This is normal. Usually this space is used by the file system itself.
• When you delete a file or folder and Time Machine is turned on, the system may not delete the files entirely, but move them to the purgeable space, causing it to grow by the corresponding amount. However, the system often delays updating the size of the purgeable space by few minutes. During this delay, you may temporarily see the hidden space being “borrowed” by the equal amount. DaisyDisk will automatically refresh (without rescanning) the numbers or hidden and purgeable space after the system updates them globally.
• Also, just after you delete the purgeable space, you may temporarily see the hidden space being “borrowed” by the corresponding amount. Please allow some time (from few seconds to few minutes) before the system completes reclaiming the purgeable space in the background. The purging may be additionally delayed if the Time Machine is in process of backing up.
• If you are using third-party backup tools such as Carbon Copy Cloner (CCC), they can create their own file system snapshots. Unlike the Time Machine snapshots, the third-party snapshots are not counted toward the purgeable space, but toward the still hidden space. You can check for presence of any third-party snapshots using tmutil listlocalsnapshots / command in Terminal. In order to reveal and delete such snapshots, please use the corresponding third-party apps. For example, here’s how you delete a snapshot created by CCC.
• Large amounts of hidden disk space may also indicate errors in the file system. You can use the Disk Utility to verify and repair your disk’s integrity. In some cases, you may need to boot your Mac in Recovery mode and run the Disk Utility from there.
• In the most obstinate cases with APFS disks, you may need to use the lower-level `fsck_apfs` command-line utility to verify and repair the APFS volume from the Recovery mode.
• Similarly, for HFS+ disks, you may need to use `fsck_hfs`. Beside verifying, you can use it to repair the HFS+ catalog file. WARNING: this operation may not be safe for your data! You should make a full backup of your disk before trying. Please seek professional help on the matter.
• Some backup tools are known to leave garbage in /Volumes folder. Check it out with the Terminal app.
• If nothing of the above helps, please contact our support.

There may be something unusual about your installation and setup. When I run DaisyDisk on my Mac, it shows zero for"Hidden Space." Not the instructions above to see if CCC has created snapshots that account for the "hidden space."

PiotrRutkowski wrote:

I bought Daisy Disk and I found hidden snapshot named "DiskStation._afpovertcp._tcp.local" wit 132 GB size. Disk Daisy is not able to delete it. I also use CCC for Synology NAS backup. Is it possible that this tool also creates it's own hidden partition?

I believe DaisyDisk can delete it if you specify to run DaisyDisk as "administrator." It may also find additional large files when run that way.

If that is really a snapshot, you can open Disk Utility, select View - Show All Devices, and then select your user data drive along the left. It will list all snapshots. You can delete those snapshots from within Disk Utility, you can probably delete all but the newest two or three such snapshots.

That may not really solve your issue, because the vast majority of users have snapshots and operate their Macs without running up such a backlog of disk space usage. I wonder if running CleanMyMac plus Onyx plus BuhoCleare (? what is that tool? I think it is yet another "cleaner" program, those are usually not good to utilize and when you have ~ 3 of them at once, unpredictable results can be expected as they sometimes work at cross purposes with the MacOS, which does its own normal housecleaning on its own) has disrupted your system to the point that it may be in an unstable state with respect to storage management.

CCC simply clones data and files and folders from your Mac to external storage; I do not believe CCC creates any hidden partitions or even takes up significant space on your internal drive. If the NAS destination was somehow unavailable, backup programs MIGHT (I doubt it) create a backup on the internal drive but I would think you would be notified about that first before that happens.

PiotrRutkowski wrote:

Big problem with full SSD

My system is a MacBook Air M3 SSD 512GB, RAM 16GB, Tahoe 26.2.

I've been using CleanMyMac for years, but now it just doesn't seem to be able to handle it anymore. I've tried OnyX, BuhoCleare, repairing partitions (even though they were OK), clearing the cache from the Library folder, and still nothing. My hard drive is constantly full.

CleanMyMac has been known to interfere with all kinds of MacOS operation. If you search for it in Apple Discussions, there are thousands of hits describing any manner of problems. It can be very hard to uninstall or remove, and the damage is difficult to fix as it involves removal of files that should not be deleted so getting them back and configured can be daunting.

You might have a look at this: How to free up ‘System Data’ and other st… - Apple Community

"System Data" is usually a mixture of things but usually is dominated by user files from various software. This can include email and its attachments as well as some cloud storage that is mirrored on the Mac. It can also include backup "snapshots" that can be deleted using Disk Utility but those tend to return if backups (Time Machine) are not regularly done.

DaisyDisk will show you exactly where every MB of space is being used on your Mac. It is not free but might be worth having in your situation.

As an example of how the Mac sorts things into "System Data" that is somewhat unpredictable, on one of my Macs I have 26 GB in my Photos system library but another 130 GB of other Photos libraries or other image files (photos). My Mac shows 26 GB in the "Photos" category which is correct, but the other 130 GB of photos is accounts for some in System Data and some in Documents, as best I can tell. So it's not a good representation. I would use DaisyDisk instead.

There are two schools of thought when dealing with CleanMyMac aka “ BrickMyMac “

CleanMyMac , aka “ BrickMyMac “

The steps in #1 below is predicated on the Offending  Application has been Removed as per the Developers Specific Instruction 

# 1 Some Contributors suggest restarting in Recovery Mode and choosing to Reinstall the Operating System over the existing installation. 

This may or may not replace elements of the  Home Folder ( User Account )  and replace any corrupted or removed elements and make things right.

#2 - Then there are Other Contributors ( like myself ) would suggest  from this link Use Disk Utility to erase a Mac with Apple silicon.

For Intel computer >> Use Disk Utility to erase an Intel-based Mac followed by How to reinstall macOS

Thereafter to start from scratch and install all Required Applications directly from the Apple Apps Store or Directly from the Developer.

If going this route - I suggest Not using Startup Assist to migrate things back as this will probably Re-Introduce the existing  issue at the time TM Backup was made 

PiotrRutkowski wrote:

• Yes. Granted full disk access for Daisy Disk (will call it DD).

Daisy Disk is a 3rd party product. You will have to contact the developers of Daisy Disk for support.

As a developer myself, I do know something about the capabilities of apps with respect to these hidden data structures. They are "not much".

I completely uninstalled CCC.

Means nothing. If CCC has created 300 GB of snapshots and then you uninstall CCC, those snapshots will remain forever.

You may be able to delete them in Disk Utility, but I'm not 100% certain. The ability to create a local snapshot requires special permission from Apple. As a well-known developer of backup software, CCC does have this permission. But since I don't use it, I don't know if Disk Utility can delete those snapshots. I know that Daisy Disk cannot.

I removed TimeMachine backup NAS destination folder -> so my TimeMachine function is not active.

Almost the same as above. The only difference is that since Time Machine is a system service, people like me can play around with it and confirm various capabilities. For example, I know that Disk Utility can delete these Time Machine snapshots. Even (the non-Mac App Store version of) Daisy Disk can delete them by using Apple's "tmutil" tool.

What is happening when I try to erase this snapshot with DD:

after opening DD, I do itinitial scan of the whole disk

• then I click the yellow area the stands for ".timemachine Volume"

• after catching the file DD shows message ".timemachine is required by macOS and should not be deleted"

"delete area" in DD shows sign STOP -> see attached photo

• https://discussions.apple.com/content/attachment/e45c0fa7-010b-4b12-8d9f-38b9f54a89e6

1.

Little different is the situation with "hidden volume" that is about 158GB size. Here I have two ways:

To reiterate, we don't know anything about DD. It is explicitly saying "volume", so perhaps it is really talking about a volume. You can't delete volumes. You could unmount (or eject) the volume. And then you could delete the local snapshot that the volume was created from. But I definitely know you're spinning your wheels (i.e. going around in circles) here.

When I try to catch the pink area, them DD immediately shows message ""Hidden are can not be deleted".

•

2. When I click the pink area and enter into it:

DD ask me to scan it again with administrator priviliges

• I allow for it

• the I see following window

https://discussions.apple.com/content/attachment/2903fb08-9fe1-4959-ad66-7807cd39b094•

so I catch the area and drag it to the "delete area of DD" - see pic

https://discussions.apple.com/content/attachment/3bea8cfb-a158-4160-8a80-c77466ccd9f1•

then I click REMOVE

• DD counts 5->1

• DD show message "Scanning snapshots..."

• DD shows message "Some files will not be removed" - see pic

https://discussions.apple.com/content/attachment/b6bd4671-9fb3-4c27-baad-39eea0174d04

All I can say about this is to thank you for confirming my decision to use a more straightforward pie chart in my storage management tool. I have no idea what all that is about. My app doesn't allow you to even attempt to delete "free space" or "other files".

PiotrRutkowski wrote:

The free space on the drive was initially about 300-400MB

I think that's a typo, but ironically enough, it's probably more correct than you think. There are only a couple of secret places that will actually tell you "free space". Almost everywhere, it will report "available" space. "Available" space is a fantasy. No such thing exists. Ignore any equations that people post about free space + purgeable, yada, yada, yada. No. It's a fantasy. Think unicorns and fairies. That kind of fantasy.

You almost certainly had 300-400 Megabytes of free storage.

and now it's... about 2GB.

You're making progress! Good!

I'm freeing up gigabytes, and the only thing that's growing is "System Data."

You aren't "freeing" up anything. You're not allowed to do that. Are you the "deleted" operating system daemon task? I don't think so. Therefore, you aren't "deleting" anything. After a day or so, said "deleted" task will run and actually delete those files. If you're lucky, then you'll get that space back as truly "free" storage. But then again, you might not be lucky. There can be many complications.

I've been using CleanMyMac for years, but now it just doesn't seem to be able to handle it anymore. I've tried OnyX, BuhoCleare, repairing partitions (even though they were OK), clearing the cache from the Library folder, and still nothing. My hard drive is constantly full.

That's the problem with those "cleaner" apps. There really isn't anything to "clean". Your system isn't "dirty". Those caches are designed to speed up your system. So when you delete them, your system runs more slowly. Then you buy more "cleaning" apps.

Wha't going on?!?!

You're out of storage. There aren't any magic tricks to create more storage. You've let the computer get out of control. I'm pretty sure Carbon Copy Cloner does use local snapshots, so you can delete that using Disk Utility. And if you have Time Machine snapshots, you can delete those using Disk Utility.

But all of that is strictly an emergency "fix". You haven't solved anything. Aren't you using those backup tools for a reason? You're essentially deleting your backups, along with your caches. And there is an extremely high possibility that you have at least one cloud sync service that will simply fill up any newly freed storage within seconds.

Storage is a finite resource. You need to keep about 100 GB of free (truly "free", not "available") storage at all times. Any less than that, and you'll start to have performance problems. Once it gets very low, then it can reach all consuming levels, which is where you are right now.

CleanMyMac has always been a problem and known here as BrickMyMac for that very reason. You can certainly use the Search option on the top of this page and enter "CleanMyMac" for a complete picture of what you are dealing with. The recommendation for removal has been consistent and many times MacPaw makes it very difficult to remove their software. Some have had to completely erase their drive.

Beyond that disclaimer, with a SSD drive the space is not freed up immediately and you have little control over the TRIM process that runs in the background that frees the space that you have marked for deletion. Previously with the mechanical HD, when you marked a file to delete, the space was available immediately and that data remained on the drive until it was overwritten.

With a SSD drive, space is not available until that data has been zeroed out and that is the TRIM process that runs in the background at a time the OS finds as convenient. It could take a day or two for that to happen and is more problematic when the drive is full. Don't confuse Free Space with Available Space, the two terms are used frequently and not the same thing. Disk Utility will report the Free Space and is more accurate than what the Finder refers to as Available space. Third party software may use either.

@etresoft

If this is any use visa vie CCC Snapshot

https://support.bombich.com/hc/en-us/articles/21385447480983-Snapshots-and-space-concerns-Deleting-snapshots