Can't delete files (chflags nouchg and cmd+S boot fail)

Look at the file(s) using

/bin/ls -leO@ filename
id -a

It is possible you are not the owner,

It is possible that the file(s) have a protection ACL (the e of -leO@ should tell you about any ACLs).

Are you trying to remove the files using Unix rm command (a dangerous command), or just trying to empty the trash from the Finder?

Have you tried holding the Option key while clicking Finder -> Empty Trash?

/bin/ls -leO@ do not return nothing

That is impossible. It has to return something. An error or the long ls output for the file (or files) you specified

Try these ls commands:

sudo /bin/ls -dleO@ /Volumes/pippo/.Trashes/501/Themes.app/Linen Book_10x7.kth/thumbs/mt0-21.tiff
sudo /bin/ls -dleO@ /Volumes/pippo/.Trashes/501/Themes.app/Linen Book_10x7.kth/thumbs
sudo /bin/ls -dleO@ /Volumes/pippo/.Trashes/501/Themes.app/Linen Book_10x7.kth
sudo /bin/ls -dleO@ /Volumes/pippo/.Trashes/501/Themes.app

Is /Volumes/pippo an external disk, or is it a network volume?

If this is a network volume, then you may not be able to delete these files from your Mac. You may have to go to the server to delete them.

If this is an external disk, then maybe something can be done.

sudo /bin/ls -dleO@ /Volumes/pippo/.Trashes/501/Themes.app/Linen Book_10x7.kth/thumbs/mt0-21.tiff
returns
ls: /Volumes/pippo/.Trashes/501/Themes.app/Linen: No such file or directory
ls: Book_10x7.kth/thumbs/mt0-21.tiff: No such file or directory

My bad, I did not notice the space in the filename, so the shell treated this as 2 filenames when there was only one. I should have either backslashed the space, or put the filename in quotes.

sudo /bin/ls -dleO@ /Volumes/pippo/.Trashes/501/Themes.app/Linen Book_10x7.kth/thumbs
returns
ls: /Volumes/pippo/.Trashes/501/Themes.app/Linen: No such file or directory
ls: Book_10x7.kth/thumbs: No such file or directory

Same space problem

sudo /bin/ls -dleO@ /Volumes/pippo/.Trashes/501/Themes.app/Linen Book_10x7.kth
returns
ls: /Volumes/pippo/.Trashes/501/Themes.app/Linen: No such file or directory
ls: Book_10x7.kth: No such file or directory

Again a space

sudo /bin/ls -dleO@ /Volumes/pippo/.Trashes/501/Themes.app
returns
drwxrwxrwx 3 _unknown _unknown - 102 31 Ott 13:54 /Volumes/pippo/.Trashes/501/Themes.app

The owner is not you.

The good news is that there are no chflags nor ACLs on the file. Only the ownership is affecting your ability to remove these files.

If this is an external disk (not network) I think you should be able to remove all the Themes.app files using:

sudo rm -rf /Volumes/pippo/.Trashes/501/Themes.app

For the files on the desktop the situation is different:

+sudo /bin/ls -dleO@ /Users/cee/Desktop/CorruptedFiles/a/mt0-21.tiff+
returns
+drwxrwxrwx 2 _unknown _unknown sappnd 68 1 Gen 1970 /Users/cee/Desktop/CorruptedFiles/a/mt0-21.tiff+

This is a directory and you do not own it. Repeating myself, if this is a network volume, you cannot delete it, and will have to go to the server.

If this is an external disk, the following should work:

sudo rm -rf /Users/cee/Desktop/CorruptedFiles/a/mt0-21.tiff+

+sudo /bin/ls -dleO@ /Users/cee/Desktop/CorruptedFiles+/a
returns
+drwxr-xr-x 3 cee staff - 102 28 Ott 19:09 /Users/cee/Desktop/CorruptedFiles/a+

If an external disk (not a network volume), then:

sudo rm -rf /Users/cee/Desktop/CorruptedFiles/a+

I also have b,c and d in CorruptedFiles folder.
Maybe the problem is in the _unknown (?!)

Again, if not a network volume:

sudo rm -rf /Users/cee/Desktop/CorruptedFiles/b+
sudo rm -rf /Users/cee/Desktop/CorruptedFiles/c+
sudo rm -rf /Users/cee/Desktop/CorruptedFiles/d+

Assuming I got the names correct.

By any chance is the volume marked "read-only"? A read-only file system will show a pencil with a slash through it just under red button in a Finder window. Or

mount | grep -i pippo

whould show "read-only". An external volume that was marked read-only would never allow deleting anything.

The other possibility is that the file system needs to be repaired. You could boot from the installation DVD and then from the install menu select Disk Utility and Repair your boot disk. The external disk can be repaired without booting from the DVD.

And as has been my luck of late, none of the above is the right answer 🙂

sudo rm -rf should be able to delete anything on a local machine which is not on a read-only file system. It is also why it is a very dangerous command as you can easily shoot yourself in the foot (which I've done more than once in my life 🙂 ).

The volume pippo, can it be mounted on another Mac, and the delete attempted there?

I figure if the problem moves with the file system, then it is a problem with the file system.

If the problem does move with the file system, and Disk Utility (fsck) repairs do not correct the problem, I would suggest doing a full backup and restore of the file system using something like SuperDuper (free for a full clone), or Carbon Copy Cloner.

If you have another Mac to work with, I would put your Mac in Firewire Target mode (essentially making your Mac a big external disk enclosure), mount your Mac's disk on the other Mac, and see about using the other Mac to delete the Desktop/Corrupt files.

Again if the problem moves with the file system, and Disk Utility repair does not correct the problem, I would consider again a full backup and restore using SuperDuper or Carbon Copy Cloner.

In this case, I would boot from the clone to make sure all is well before doing the restore.

A lot of good ideas.
As soon as possible I'll try but I have another question: if I'll make the restore from a CCC sparseimage will I restore also the filesystem problem?
Maybe is a stupid question but....... quandoquidem dormitat etiam Omerus

SuperDuper (my favorite and free for a full clone) as well as Carbon Copy Cloner copy the contents of each file. The restore is to a newly created empty file system, again just copying the contents of the files back.

However, one thing you could try before doing the restore. Mount the backup clone (and if you use a sparse image, hopefully it is a read/write image), then see if you can delete the problem files while they are still part of the backups.

That way if for some reason I'm wrong (how could that ever happen 🙂 ) you will know before spending time doing the restore. And if you do manage to delete those files on the clone, then when you restore they will already be gone.

If you want to experiment, it is possible to have Carbon Copy Cloner backup a single directory tree, then you can choose just one of the problem directories, and see if you can delete the offending files in this mini experimental backup. This will also save time before doing a full backup/restore.

If you are not deleting many files, you can add the interactive flag to the rm command. This will ask you to confirm the delete.

rm -i filename


If you get tired of answering the confirm command, you can always press:
control+c
to cancel.




sudo rm -rfi /Users/cee/Desktop/CorruptedFiles/b+


-------------



Here is an overview of the terminal commands. Lets assume that your account has a short user name of mac.
Macintosh-HD -> Applications -> Utilities -> Terminal
#How to list all of your disks.
# The ls command is for li st
mac $ ls /Volumes/
Audio CD Macintosh-HD Spotless Tiger-ext
mac $


# Let's say your flash drive is named Spotless

# cd is change directory
mac $ cd /Volumes/Spotless
# pwd is print working directory
mac $ pwd
/Volumes/Spotless
mac $




# The ls command is for li st
# l is long
# F is type of file where / is directory
mac $ ls -lF
total 134704
-rw-r--r-- 1 mac staff 64560 Mar 3 2009 A-picture-of-Youpi-key.png
drwxr-xr-x 83 mac staff 2822 Nov 7 14:52 Applescript files/
drwxrwxrwx 12 mac staff 408 Dec 13 2008 Christmas Cards/
drwxr-xr-x 9 mac staff 306 Dec 21 17:39 Christmas Cards 2009/
... trimmed ...


What does all this mean?

drwxrwxrwx

d = directory
r = read
w = write
x = executeable program

drwxrwxrwx
| | |
| | all other users not in first two types
| |
| group
|
owner



# l is long
# a is all to show hidden files & folders
mac $ ls -lFa
total 134736
drwxr-xr-x 41 mac staff 1496 Dec 22 17:11 .
drwxrwxrwt 8 root admin 272 Dec 24 13:55 ..
-rwxrwxrwx 1 mac staff 15364 Dec 23 12:52 .DS_Store*
drwx------ 4 mac staff 136 Jan 22 2009 .Spotlight-V100
drwxrwxrwt 5 mac staff 170 Sep 14 16:36 .TemporaryItems
d-wx-wx-wx 4 mac staff 136 Dec 31 1969 .Trashes
-rw-r--r-- 1 mac staff 64560 Mar 3 2009 A-picture-of-Youpi-key.png
drwxr-xr-x 83 mac staff 2822 Nov 7 14:52 Applescript files
drwxrwxrwx 12 mac staff 408 Dec 13 2008 Christmas Cards
drwxr-xr-x 9 mac staff 306 Dec 21 17:39 Christmas Cards 2009
... trimmed ...



# mv is move or rename
mv -i the-name the-new-name

# You can just rename the file back to what it was with mv command.
mv -i old-name new-name

Here is what these commands mean:
cd is change directory
pwd is a print working directory
ls is list
sudo is Super user do
mv is move or rename

For cryptic comments, you can always uses the manual command which is man. For example:
man mv

# Type the letter q to quit.

I noticed that you had spaces in your filenames or directories. You need to escape them. See examples:

mac $ ls -l ~/"see it"
-rw-r--r-- 1 mac staff 3171 Oct 26 23:38 /Users/mac/see it
mac $
mac $ cd /Users/mac/Desktop/ttt\ html\ copy/

Do you know about tabing? Type in a few letters of a name then press the tab key. The computer will type out the rest of the name if it is unique.

Press the up arrow(s) key to see the previous command(s).

history to see many previous commands.

mac $ history
2 man launchd.conf
3 history



Robert

The system-append-only flag is set on /Users/cee/Desktop/CorruptedFiles/a/mt0-21.tiff. You can't delete that file, even as root, while the system is running in multi-user mode. Boot in single-user mode and do this:

mount -uw /
chflags -R nosappnd noschg /
exit

Then reboot in multi-user mode and delete the files. Unsetting the uchg flag won't help you, because that flag isn't set.

..." The system-append-only flag is set on /Users/cee/Desktop/CorruptedFiles/a/mt0-21.tiff. You can't delete that file, even as root, while the system is running in multi-user mode."...

Has Apple changed this back in 10.6? I don't have Snow Leopard.

In 10.5, the ' kern.securelevel' was reduced to ' 0' meaning that ' schg' and ' sappnd' flags did not require booting into single-user mode in order to remove them (regular "root" access or ' sudo' was sufficient).

It's easy enough to bump back to ' 1' but I was (and am) annoyed that Apple didn't bother to document a reduction in default security settings so it wouldn't surprise me if they changed it back, again without telling anybody...