Where has all of my hard drive space gone? (Intel Mac, OSX 10.5.1)

January 1, 2008 10:06 AM

Where has all of my hard drive space gone? (Intel Mac, OSX 10.5.1)

System is an Intel iMac, Core 2 Duo, 250 GB HD, running OSX 10.5.1. Previously my internal drive was almost full (less than 5 GB remaining). For Christmas I got an external 500 GB FW drive and moved all my media files to it. This left me with aprox 200 GB free on my internal. A few days later I noticed that finder said I only had aprox 7 GB free on the internal. During that time I had set a TON of stuff to queue for download in Shakespeer, so I thought that must have been the cluprit. I removed everything from my cue, but it still reported 7 GB free. I used DiskInventoryX to see what the large files were. When it initially opens it also reports the 7 GB free, but when I select the disk and let it run the scan it says only 18.6 GB in use, and there are no large files at all. I've since deleted the download folders that Shakespeer created just to see if that might do something, and it's now at 9.47 GB, but no where near where it should be. Can anyone offer any help?

posted by drgonzo2k2 to Computers & Internet (28 answers total)

is the Trash empty?
posted by mpls2 at 10:26 AM on January 1, 2008

Er, have you emptied your trash?
posted by Happy Dave at 10:27 AM on January 1, 2008

Use Disk Inventory X to get a graphical representation. Also of note (but probably not in this case) is that if you use File Vault, it only clears up unused space in the sparseimage when you log out.
posted by adampsyche at 10:29 AM on January 1, 2008

Also I noticed that depending on your settings, iTunes will frequently copy files into its directory structure instead of using them where they exist. I saved a bunch of space by just getting rid of the dupes.
posted by bitdamaged at 10:43 AM on January 1, 2008

Could be a filehandle still open for a file that has already been deleted (that's really deleted, not just trashed). There is no longer a directory entry, but until the filehandle is closed, disk space is still allocated (and can even grow if the process keeps writing)

A reboot would fix this.. so try that if you haven't already.
posted by TravellingDen at 11:01 AM on January 1, 2008

i regularly use WhatSize to check that out. It is set up very well, and clearly organizes your files from largest to smallest... duplicate itunes entries as bitdamaged mentioned are frequently the culprit, but whatsize will tell you where the duplicates are, and if there's anything else that's hogging room.

I also suggest Monolingual which allows you to remove all those languages you're never going to use (be careful to keep english and a few others around).

Print drivers are another space saver i've nuked...i only use two printers, and the rest of the 3 or 4 gigs of print drivers got trashed.
posted by furnace.heart at 11:05 AM on January 1, 2008

Seconding Disk Inventory X it helped me locate my 'missing space' just a few weeks ago.
posted by Kristan at 11:12 AM on January 1, 2008

I forgot to mention.... I recently read about App Delete which won't tell you where your space has gone but in the future could ensure you delete everything when getting rid of applications, recovering more disk space.
posted by Kristan at 11:14 AM on January 1, 2008

Leopard can suck disk space mysteriously in a few circumstances, due to overly aggressive Spotlight or Time Machine configs.

See here and here.
posted by Caviar at 11:18 AM on January 1, 2008

Also, the amount of disk space taken for virtual memory paging files varies based on RAM usage. On my 2gb machine now there's a 2gb sleepimage and 3gb of swapfiles (look in /var/vm to see on your machine), but if I get all my media applications running at once that will grow even more.
posted by misterbisson at 11:29 AM on January 1, 2008

Kristan (& OP)-- You might want to check out AppTrap instead. I believe App Delete requires you to have it open and then you drag the app onto its icon. With App Trap you just drag the app to the trash and it gives you the option of deleting all related files. Also free.
posted by sharkfu at 11:30 AM on January 1, 2008

If you have Symantec Anti virus 9 installed it creates an error log that can grow to fill the HD. look in the Applications support folder/ Symantec folder.
posted by Gungho at 11:34 AM on January 1, 2008

A similar question posted recently; if you are comfortable with the Terminal you might try my advice in that thread to track down where the offending files are.
posted by ikkyu2 at 12:01 PM on January 1, 2008

You say you already used Disk Inventory X, but *how* did you use it? A more effective way to find all big files is to do a custom Spotlight search of the drive looking for all files that are 10MB or larger, then sort the results list by size. It'll take a while to do the search. Work your way down the results list to decide what should stay and what should go.

Also, I'm totally not convinced that you got all the Shakespeer files. So, add one more thing to your custom Spotlight search: also look for files modified since you first cleared off your internal drive and having a size larger than 10MB. It should be enlightening. Alternately, look in the Shakespeer preferences to see what two folders are set to receive Downloading items and Complete items. Empty them if you haven't already.
posted by Mo Nickels at 12:39 PM on January 1, 2008

You can do what everyone up there says, but bet you it's this:

1. Enable root user (follow directions under the Help menu).
2. Launch Terminal, enter in these commands:
2.1 %su root
2.2 % (enter password)
3. cd /var/spool/cups
4. rm -rf *

Triple check you are in the correct directory before you do this. And you can use WhatSize like someone suggested about to make sure this is the directory that's giving you fits, but I have a shiny new Delaware quarter that says it is.
posted by cjorgensen at 1:00 PM on January 1, 2008

Response by poster: Hey, thanks everyone for all of your help. I have verified that both the Download and Incomplete folder for Shakespeer are empty. I have emptied the trash. I do not use FileVault, and iTunes is set to use the files on the external drive (library file is there too), and to let me manage my library, so it does not copy anything back over. I've ran a full Verify and Maintenance pass with Onyx, and in addition I have verified the disk and repaired permissions using Disk Utility. At this point it has been rebooted several times.

As you can see here Finder shows only 9.55 GB free. As you can see here and here both WhatSize and DiskInventoryX initially report the same things, but when you let them run their scans they both only show a little over 18 GB being used on the disk.

Following lkkyu2's advice, I ran the "sud du -hd1 /" command and got the following:

1.1M /.fseventsd
187M /.Spotlight-V100
0B /.Trashes
0B /.vol
3.9G /Applications
7.5M /bin
0B /cores
2.0K /dev
1.0K /home
1.8G /Library
1.0K /net
0B /Network
658M /private
5.3M /sbin
3.2G /System
9.3G /Users
975M /usr
415G /Volumes
435G /

As you can see nothing seems out of line there. Any additional help would be greatly appreciated!
posted by drgonzo2k2 at 1:51 PM on January 1, 2008

I'm guessing you've got local directories under the /Volumes directory.

Would you mind trying "sudo du -h -d1 -x /Volumes"?
posted by Kip at 4:38 PM on January 1, 2008

Drgonzo2k2, there is something out of line there -- the 415G in the /Volumes directory. Look there and tell us what you see.
posted by delfuego at 5:56 PM on January 1, 2008

Response by poster: Here is the output from the command "sudo du -hd1 -x /volumes"

202G /volumes/Dr. Spang's Monster
0B /volumes/The Evil Dr. Spang
202G /volumes


Those are 2 external FW hard drives that I have hooked up, and the used space is correct.
posted by drgonzo2k2 at 7:49 PM on January 1, 2008

The -x option I suggested for the du command tells it not to check other drives, so you appear to have an additional copy of the Dr. Spang's Monster actually on your internal drive.

You can verify this by ejecting your external drives for a bit and doing the same command again.
posted by Kip at 9:13 PM on January 1, 2008

Response by poster: Wow, Kip, you're right! I just disconnected the drives and ran the command again. It still shows the 202 GB under /volumes/Dr. Spang's Monster. 202 GB is actually slightly outdated for this drive as it is currently 213 GB. I'm not sure what happened, but it appears that some time ago it copied this drive to the /volumes folder. How did that happen, and more importantly, how do I get rid of it now?
posted by drgonzo2k2 at 2:33 AM on January 2, 2008

Response by poster: Would the proper command at terminal be "sudo rm -r /volumes/Dr. Spang's Monster" ?
posted by drgonzo2k2 at 2:40 AM on January 2, 2008

Here's what happened - a "disk" in Unix is just a mount point somewhere under the root directory, and the mount point is just a special kind of folder. It's possible for the mount point folder to exist even when the disk isn't mounted, and at some point, you copied stuff to that disk when it wasn't plugged in, or turned on, and the system just copied everything you meant to copy to the disk to a folder named the same thing instead. Normally, for removable disks, the mount folder is removed when the disk is removed, but for some reason, that didn't happen here. When you plug in the disk, the disk mount takes over that mount point, but when you remove it, there's still stuff on the main disk there that was hidden while the removable disk was mounted.

Disconnect the drive, then do

sudo rm -rf "/Volumes/Dr. Spang's Monster"

posted by Caviar at 6:56 AM on January 2, 2008

Response by poster: Ok, I'll give that a try when I get home. Just to clarify - do I need the quotation marks or not?
posted by drgonzo2k2 at 7:22 AM on January 2, 2008

Yes, you do need those quotes, because your HD name has spaces in it.

Be very careful when typing in the sudo rm -rf command. Typing errors when executing this command can have unpredictable results; if you really botch it you can erase your HD.
posted by ikkyu2 at 7:37 AM on January 2, 2008

Actually, you can just start typing

sudo rm -rf /Volumes/Dr

and then press tab, and the shell will expand it for you with everything properly escaped. Then just press enter.

Yes, be very careful with this and make sure you're deleting the proper thing before you press enter. rm does not move things to the trash, they're gone forever.
posted by Caviar at 8:17 AM on January 2, 2008

Response by poster: Thanks MeFites! That did the trick and all is back to normal. Now can anyone shed any light on why this might have happened?
posted by drgonzo2k2 at 10:25 AM on January 2, 2008

Very likely, something you used to copy files to the removable disk thought the disk was attached when it wasn't and it created the folder underneath /Volumes.
posted by Caviar at 6:45 AM on January 3, 2008