System Files 465 GB - What Is Going On?

I just checked the Storage in System Information on my MacBook Pro and I almost fainted. It reports 465 GB of system files!!! And my 1 TB SSD HDD is now almost full. How could this possibly be? Please see the attached screenshots.


HELP! What should I do about this situation? Thank you very much.User uploaded fileUser uploaded file

MacBook Pro with Retina display, macOS High Sierra (10.13), i7 2.6GHz, 16GB, 1TB SSD

Posted on Sep 27, 2018 7:14 PM

Reply
Question marked as Top-ranking reply

Posted on Sep 27, 2018 7:21 PM

Those are estimates, based on Spotlight index data. If you have done a re-Install, the new added files are correctly reflected, but the old ones are not removed. To get a more accurate estimate, rebuild the index:


How to rebuild the Spotlight index on your Mac - Apple Support




.

Similar questions

21 replies

Sep 29, 2018 3:04 PM in response to Michael9009

You should not be finding Backup files on your boot drive. If you had just connected the Backup Disk and let Time Machine run, it would remove them for you. But now that you dug yourself this hole, see if this article by the late James Pond can help get rid of them:


.Pondini's Time Machine - Troubleshooting -- E6. Can't empty the trash after deleting backups via the Finder


.

Oct 2, 2018 4:48 PM in response to Michael9009

UPDATE:


  1. I was able to delete the files in /.Trash by briefly turning off SIP and then, after emptying the Trash, turning it back on.
  2. Before that I had updated to macOS Mojave without any issues.
  3. I was able to free up 400 GB on my HDD, possibly consisting of local backups that, for some unknown reason, were not transferring to the Time Capsule and to the other external drives.
  4. The computer performs backups as it should normally do.
  5. All external backups appear fully functional. I can access any of them at any dates, on the Time Capsule and the external drives.


Currently, System Information shows 65 GB used by System. Is this roughly what is supposed to be? Or is it still too large?


User uploaded file

Sep 29, 2018 4:39 PM in response to Michael9009

Hello,

Unfortunately, you have corrupted your backup. Before doing anything else, you will need to erase your Time Machine backup drive and make a new backup. Depending on your machine, this could take several hours, perhaps even a day or more. LET IT RUN. Restoring your backup is your #1 priority. You should not attempt an upgrade to Mojave at any time in the near future.


The 465 GB of system files is just a display bug in the operating system. That display you are looking at is just wrong.


It is probably correct about the 47 GB of free space. You should consider buying an external drive to use for archiving your files. Since your current Time Machine backup was trashed, you might even consider buying a new 2 TB drive for Time Machine and making your backup to that new drive. Then, erase your old Time Machine drive and use it to archive your files. I'm sure you don't need 950 GB of data available at all time.


Once you have a couple hundred GB of free space, then you can consider upgrading to Mojave. Can you upgrade with less than 200 GB? Of course. Maybe you will have a couple of days or a couple of weeks before your machine experiences an unrecoverable crash. Even if you did have a Time Machine backup at that point, it would probably be too much data to restore. You can either make 200 GB of free space on your own, or forge ahead and let fate give you about 980 GB of free space.

Sep 30, 2018 1:28 PM in response to Michael9009

Michael9009 wrote:


No, it’s not the backup that’s corrupted. I’ve got backups on a Time Capsule as well as on two other external hard drives.

Not anymore.


The problem is how could I delete those six files in the /.Trash folder?

The best you can hope for is to use Finder's "Put back" feature. That will get them out of the trash and back to where they came from. But there is no way to tell if the Time Machine system they came from will ever be functional again.


I'm sorry I didn't see your question sooner. I saw that one post about using some "Dr." scamware app and though I should say something before it was too late. Unfortunately I didn't make it.


I'm not sure what the state of your Time Machine backups is at this time. You said:

I was able to change the permission to the Time Machine Backups in the /Volumes folder, mover everything to the Trash and, after emptying the Trash, 600k+ entries were deleted.

The Time Machine backup represented by "Time Machine Backups" is dead. Full stop. You can erase it and use it for backups again at some point in the future after you've recovered.


And then you said:

du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/SafariFamily: Operation not permitted


du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyNameMacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.LaunchServ ices.dv: Operation not permitted


du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.nsurlsessi ond: Operation not permitted


du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.routined: Operation not permitted


du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyNameMacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessi ond: Operation not permitted

To recover from this, try to use Finder's "Put Back" option. I don't know if it will work if you have scrambled the place it originally came from. It may be a moot point anyway.


Unfortunately, now I see:

du: /Users/MyName/.Trash/ConfigurationProfiles/Store: Operation not permitted

This means that your entire machine is likely irreparably damaged.


Do you have any Time Machines backups that were not affected? Do you have any complete backups from before you started deleting files?


It is difficult to look into someone else's machine via the internet like this. All of the evidence I've seen suggests that your only option is to erase the hard drive on your machine and restore from a backup. You said you have backups on two other machines. Having multiple backups is always a good idea. You need one now.


Once you get the machine restored back to a point on or before Sep 27, 2018 10:14 PM, then you're done. Ignore anything that macOS says about "Storage" or anything the Finder says about "available space". You have used the Terminal. You can try the command "df -h". I'm afraid that's as good as it gets on macOS circa 2018.

Sep 27, 2018 8:01 PM in response to Grant Bennet-Alder

On another site, I've read to run this command: sudo du -d 1 -x -c -g / and here is the result, before re-indexing - although I am not quite sure what it means:


0 /.HFS+ Private Directory Data

1 /home

1 /usr

2 /.Spotlight-V100

1 /net

0 /.PKInstallSandboxManager-SystemSoftware

1 /bin

1 /Incompatible Software

0 /Network

1 /sbin

13 /Library

0 /.Trashes

16 /System

1 /.fseventsd

du: /private/var/db/ConfigurationProfiles/Store: Operation not permitted

du: /private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/SafariFamily: Operation not permitted

du: /private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.LaunchServic es.dv: Operation not permitted

du: /private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.nsurlsession d: Operation not permitted

du: /private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.routined: Operation not permitted

du: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsession d: Operation not permitted

4 /private

1 /.DocumentRevisions-V100

0 /.vol

451 /Users

41 /Applications

1 /dev

du: /Volumes/Time Machine Backups/Backups.backupdb/Michael’s MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/db/ConfigurationProfiles/Store: Operation not permitted

du: /Volumes/Time Machine Backups/Backups.backupdb/Michael’s MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/SafariFamily: Operation not permitted

du: /Volumes/Time Machine Backups/Backups.backupdb/Michael’s MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.LaunchServ ices.dv: Operation not permitted

du: /Volumes/Time Machine Backups/Backups.backupdb/Michael’s MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.nsurlsessi ond: Operation not permitted

du: /Volumes/Time Machine Backups/Backups.backupdb/Michael’s MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.routined: Operation not permitted

du: /Volumes/Time Machine Backups/Backups.backupdb/Michael’s MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessi ond: Operation not permitted

370 /Volumes

0 /cores

896 /

896 total

Sep 29, 2018 4:14 PM in response to Michael9009

Some good news. From the files below:




du: /Volumes/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/db/ConfigurationProfiles/Store: Operation not permitted


du: /Volumes/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/SafariFamily: Operation not permitted


du: /Volumes/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.LaunchServ ices.dv: Operation not permitted


du: /Volumes/Time Machine Backups/Backups.backupdb/MyNameMacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.nsurlsessi ond: Operation not permitted


du: /Volumes/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.routined: Operation not permitted


du: /Volumes/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessi ond: Operation not permitted


370 /Volumes




I was able to change the permission to the Time Machine Backups in the /Volumes folder, mover everything to the Trash and, after emptying the Trash, 600k+ entries were deleted.




BUT, not everything was deleted and the system still reports that it uses 158 GB (down from 465 GB). The files that I cannot delete are these ones:




du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/SafariFamily: Operation not permitted


du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyNameMacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.LaunchServ ices.dv: Operation not permitted


du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.nsurlsessi ond: Operation not permitted


du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyName MacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/3b/77h42vcj735db0q256qq9fsh0000gn/0/com.apple.routined: Operation not permitted


du: /Users/MyName/.Trash/Time Machine Backups/Backups.backupdb/MyNameMacBook Pro/2018-09-24-125434/Macintosh HD/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessi ond: Operation not permitted


du: /Users/MyName/.Trash/ConfigurationProfiles/Store: Operation not permitted




If I click Get Info on any of the above six files, it shows "You have unknown access" under Sharing & Permissions. I tried everything I could think of, including Disk Aid in Recovery mode and this command: sudo diskutil resetUserPermissions / `id -u`, but to no avail.


User uploaded file


How could I get rid of these six file? Please, please help! THANK YOU!!!




[Personal Information Edited by Host]



This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

System Files 465 GB - What Is Going On?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.