ctrl.altered.mind

As you probably already know from my previous post, I’ve been on a mission for the past couple of days to try and recover as much disk space as I possibly can, so I do not have an strong excuse to immediately run out and buy a higher capacity Seagate Freeagent Pro drive (although that is going to happen sooner or later, right?).

I’ve been using the Disk Inventory X utility to get a better ahem, picture of the stuff stored on my drives. In doing so, I discovered that Apple actually maintains a copy of deleted data in not-so-plain sight on every HFS+ volume on the computer - this means every Apple partition and external drive connected to the system. While this might be a good feature to have for most people, I am usually sure of the stuff that I want deleted - especially from my backup drive volumes. You can recover a lot of drive space by cleaning out these hidden folders, depending of course, on what kind of files have been stored in them in the first place.

Each HFS+ Volume on Mac OS X has a hidden /.Trashes folder (hidden by default because of the leading ‘.’). I found quite a few deleted music and video files in this folder through the Disk Inventory X utility, and quickly went in through Terminal to clear them permanently (Finder won’t display these folders by default, more on that later).

Here are the Terminal commands you would need to execute, to achieve this result (I’m assuming you are starting out in your Home folder. ‘Hayabusa’ is the name of my external HFS+ volume, replace that with the name of your drive partition):

First, enter superuser (root) mode (careful with this - with great power, comes great responsibility)

sudo su

You’ll be prompted for your password. Enter it here.

Then, navigate to the culprit .Trashes folder on the external volume

cd /Volumes/Hayabusa/.Trashes/

List the contents. Chances are, you’ll have a bunch of folders here. Mine had two, called 501 and 502.

ls

Now, you’ll need to use your superuser powers to recursively delete a folder *along with* all its contents. This step is irreversible, so make sure you’ve stepped into each folder and checked its contents thoroughly. (If you’ve found something useful, you can copy it to another folder with the cp command). Ok, so to recursively delete, enter (where 501 is the name of the folder):

rm -r 501

Deletion has begun. If there is a privileges override required, you’ll be prompted to acknowledge the action. Reply with a ‘y’ if this happens, to continue.

Rinse and repeat for other folders that you might have in the .Trashes directory. Hopefully by the end of the process, you will have reclaimed a fair bit of drive space.

Alright, if you have quite a few folders in there, and need to turn on hidden folders view in Finder, here are a couple of commands you can execute in Terminal:

defaults write com.apple.finder AppleShowAllFiles -bool true

As with Unix filesystems, that command is case-sensitive. You will need to relaunch Finder by either executing the following command, or through the Force Quit window (Command+Options+Escape):

killall Finder

Note that performing this action will display *all* hidden folders, and there are quite a few of those. If clutter bothers you, you may not like what you see. To turn this off, replace ‘true’ with ‘false’ in the above command. So, type (in Terminal, of course):

defaults write com.apple.finder AppleShowAllFiles -bool false

As before, you will need to relaunch Finder for the change to take effect.

Whew, that was quite a tutorial - basic of course, but quite potent with the superuser mode involved. Disclaimer - I’m not responsible if you end up nuking your files through some form of user error!

Oh yes, there is one more thing! (lol) Unix (and therefore the Mac) has a secure delete command, called ‘srm‘. srm removes each specified file by overwriting, renaming, and truncating it before unlinking. This prevents other people from undeleting or recovering any information about the file from the command line (from the srm man page). Basically, this command does not just delete the file, it pretty much nukes it. If you’re paranoid about privacy and security, you could replace the rm command above with srm.

As a reference for advanced users - the srm command uses the Gutmann algorithm to secure erase data. It takes the files and overwrites it with 35 patterns, then randomizes the filename and unlinks it. OS X with HFS+ uses journaling by default, and writes an entry in the file system journal before performing any directory operation which, if not completed, could invalidate the file system. This prevents file system damage if, for example, a power failure caused an unexpected shutdown (Windows users, you are on your own). Why am I getting into journaling with this blog post, you ask? Well, if you decide to use srm, it may involve journaling - so if srm is interrupted for some reason, try it again to ensure that it completed. If so, it will not find the file the second time.

This entry was posted on Friday, June 15th, 2007 at 7:44 pm and is filed under Apple, OSX.