Help Please! Can't empty Trash

[FedoraTime]

I am running Catalina on an old (but good) iMac 27"

I deleted a user account as it just had a ton of unwanted images i have now moved to a new laptop. Trouble is, the hard drive data usage amount hasn't changed. The account has gone, every remnant I can find has gone, EXCEPT something in trash. There's just one folder with subfolders ending up a strange 'zero bytes' file. The string in trash is:

user/Library/Containers/com.apple.mail/Data/DataVaults

I have view hidden files on, the Library folder should be hidden so i can see it greyed out.

I have tried emptying trash holding Option key etc etc, it says file in use (that user account has gone, and i have rebooted many times).

I have tried terminal command to 'sudo rm [string]' but it just says 'The file is a directory'

I have tried booting into safe mode (not sure if it worked), but either way it says file in use.

I have a 2TB internal drive, of which 1.5TB was used before the deletion. It should be down to around 450GB used now, but still shows 1.5TB used, I assume because of what's in trash.

I took a carbon copy clone and that (oddly) shows only 450GB taken up by the clone backup, suggesting the data really isn't there, yet my mac login shows 1.5TB used and that item sat in trash.

Any advice or ideas greatly appreciated please!

 

[casperes1996]

I have tried terminal command to 'sudo rm [string]' but it just says 'The file is a directory'

For deleting folders and all contents within the folder with rm, it needs to be
rm -r
rm -rf
if you want to force delete.

Note that if the removed data is marked as purgeable macOS will defer actual deletion till the data is needed

 

[FedoraTime]

Thanks. I didn't understand the last line.

I tried sudo rm -rf [directory]

Fails with "operation not permitted" and "directory not empty"

Any other ideas please?

I can't understand it at all. I should have a whole terrabyte more free space than I do!

 

[casperes1996]

Thanks. I didn't understand the last line.

I tried sudo rm -rf [directory]

Fails with "operation not permitted" and "directory not empty"

Any other ideas please?

I can't understand it at all. I should have a whole terrabyte more free space than I do!

You still needed to run it with sudo privileges if anything in there is not owned by current user.

Show me the get info pane of your drive or the settings info on storage. If it’s marked as purge able that’s basically the same as free space but it’s deferred

 

[FedoraTime]

Thanks.
I ran it with sudo, entered password.
Attached screenshot of get info pane on drive.
Don't know what you mean by "settings info on storage"

 

[casperes1996]

I will be back with my Mac on Monday. Till then I can only reply from phone.
Try running tmutil listlocalsnapshots /
Also try running lsof to figure out what the system things is using the files. Iirc it’s just lsof <path to file>

 

[FedoraTime]

No joy. I will just wipe it and reinstall, thanks for your help anyway

Oh damn it, Apple won't let me install an OS to any encrypted drive. How sinister, nothing to do with their involvement in PRISM program, no I'm sure it's not.

 

[casperes1996]

No joy. I will just wipe it and reinstall, thanks for your help anyway

Oh damn it, Apple won't let me install an OS to any encrypted drive. How sinister, nothing to do with their involvement in PRISM program, no I'm sure it's not.

If you install to a regular apfs drive the data volume should automatically be encrypted. On Macs with apple silicon it is in fact impossible to not have the internal drive be encrypted though it may be set up to be encrypted with an empty password but encryption is always performed by hardware