Deleting absolutely undeletable files

Nov 24, '01 02:57:36PM

Contributed by: robg

I had somehow managed to create a file which simply defied deletion. I was pretty sure I'd created the file, as it was named "testfile" and was in my Documents folder. I'm not sure what I was testing, but the file was simply locked into place. Everything I tried failed to remove this file -- I made sure it wasn't "locked" in the Finder, I tried putting it in another folder first, and I even tried 'sudo chflags nouchg,noschg testfile' in the Terminal. Still, I couldn't even put the file in the trash, and if I tried to delete it as root, I received "Operation not permitted".

I finally killed it by switching to single-user mode and then changing the flags:

% sudo shutdown now               [ends Aqua and enter single-user mode]
% su [become root]
% chflags nouchg,noschg testfile [change the two flags I thought responsible]
% rm testfile [get rid of it!]
% exit [end root]
% exit [restart Aqua]
This did the trick; the file is now history, and no true restart was required (dropping to single-user from Aqua and then exiting back to Aqua is much faster than two restart cycles) ... my 'uptime' even survived intact :-).

Read the rest of the article if you'd like an explanation as to why this had to be done in single-user mode (thanks to Marc D. for providing the addition insight).

Marc D. writes:

In response to another recent thread regarding undeletable files, here's the story (for at least some of these cases):

The key problem is, indeed, the schg flag. If this is set, it will prevent a file from being deleted. I had this problem, and here is what I learned from solving it.

You can set the schg flag as root, in a normal Mac OS X Terminal session. But once set, you CANNOT clear the unless you go into single-user mode. Once in single-user mode, use 'chflags' to turn the schg bit off (as shown above).

Why does it act like this? Well, clearing the schg bit requires that the kernel's 'secure level' be set to 0 or less. In a standard OS X boot, the secure level is set to 1, which restricts certain functions, such as clearing the schg flag. When booted into single-user, the secure level is set to 0, which does allow you to clear to the schg flag.

Some general references on kernel security levels and chflags can be found at:
http://profile.sh/syswiki/index.php?chflags and http://profile.sh/syswiki/index.php?Changing your kernel security level.

Hope this helps.

Comments (5)


Mac OS X Hints
http://hints.macworld.com/article.php?story=20011124145736956