Disk Space Disappearing

Storage information from "About This Mac" is often not correct, because it depends on Spotlight, which is not very precise in this regard.

Open a new Finder window, right-click your Macintosh HD -> Get Info and look for "Available". That's just to make sure you have the right figures.

As you may know by now, there are several more top level folders than the four shown in your second screen shot. The normally invisible ones will account for some of the difference in the total of those four vs. the overall total.

Beyond that, folders that you do not have at least read privileges for will always show "zero bytes" regardless of the size of their contents. (You can see this in Finder for example in the subfolders of /private/var -- you will find several folders marked with a red "no entry" badge, each of which will indicate "zero bytes" in Finder & return "permission denied" if you try to get their sizes with a Terminal "ls" command.) The same is true for any other user accounts you might have in /Users/ -- only the folders you have read access for will show their actual size.

This doesn't have anything directly to do with Spotlight -- it is just a consequence of the file system's permissions restrictions. However, About this Mac > Storage, Disk Utility's used/available info, Finder's "Get Info" for the drive itself, etc. will show you accurate aggregate totals because they get that info from the part of the file system that keeps track of used & unused space without regard for what it contains. So the info shown in your first screen shot is accurate, regardless of what adding up folder totals tells you.

As for the shrinking file space issue, that is most likely the result of what is known as "local snapshots," a Time Machine related feature enabled by default on laptop Macs that stores backup "snapshots" of the state of your startup drive locally on the drive itself until the laptop can access an external Time Machine backup drive. That is nothing to be concerned about because even if you don't use an external TM backup drive the OS will automatically purge the space those snapshots use if that space is needed for permanent file storage, like for your document files.

I downloaded DiskWave & ran it on my iMac (also running El Capitan 10.11 in case you were wondering). Not surprisingly, it has the same inability to display the contents or size of folders that users do not have access to. For example, click on private > var & note that several of the folders in the last column have no size info & the small path indicator at the top of the DiskWave window shows these folders with the red "no access" badge.

This is the same thing you will see in Finder if you use its View > Go to folder (command + shift + G) menu option & enter /private/var in the text box -- folders with a red "no access" badge can't be opened nor can the size of their contents be determined.

You should also see that DiskWave's Used & Available numbers in the Devices section agree with those you get from Disk Utility, Finder's "Get Info" for the drive itself, etc.

As for how much of the missing disk space is being used by these inaccessible folders I cannot say for sure (because they are inaccessible!) but my guess is they are using that space.

You probably could be subscribed to Apple Music. That would create cache files in the cache of the user library.

In Finder menu => Select Go => Alt Library to select your user Library. Navigate to Caches folder. Open the folder. Navigate to com.apple.iTunes. By right clicking on that you will be able to get the info to obtain the size of the cache. Inside this folder is a SubscriptionPlayCache. It can grow quite substantially. You can delete the contents of com.apple.iTunes but don't delete the folder. At the same time a iAd cookie will be deleted as well.

That might be happening to your Mac

Leo

vm - about 1GB and inside is a "sleep image" - I take it that's for Time Machine.

No, the sleepimage file is a snapshot of the contents of memory (RAM), used with the 'safesleep' hibernate feature when a Mac has to kill power to RAM during sleep. If you are interested, the pmset man page has some info about that (but don't get your hopes up about disabling it -- the commands to do that don't seem to work with recent Mac models -- apparently it has something to do with autopoweroff & the "implementation of Lot 6 to the European Energy-related Products Directive").

You also should be seeing one or more 'swapfiles' in /private/var/vm/. These are where virtual memory (paged out chunks of RAM) are stored. They vary in size & number depending on the amount of RAM installed & how much data needs to be paged out.

Have you rebooted recently to clear out temporary cache and swap files? Also you can try to reindex the drive as described in this Apple document: Spotlight: How to re-index folders or volumes - Apple Support

It is very unlikely that you have discovered a disk space use issue attributable to El Capitan itself. Much more likely is that an application has a memory leak & is generating large swap files (see my earlier post about that) or something else is writing to normally hidden locations on the drive.

It is also possible what you are seeing is normal -- there are many processes that use varying amounts of disk space as temporary storage & that can change very quickly.

Another possibility is file system corruption. To eliminate that the best thing to do (as I just recently discovered from a conversation with Applecare support) is to start up in Recovery mode (by holding down the option & R keys after the startup chime) & from the menu that appears select Disk Utility. Once it opens, select your hard drive from the list on the left & click the "First Aid" button. Running Disk Utility's First Aid from the Recovery partition can repair much more than running it from the normal startup drive.

Another thought: if you have Time Machine enabled and don't have the external HD connected for the backups you'll get local snapshots created on the boot drive that can take up space. This website describes it: What are Local Snapshots.

.