Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

10.3: Use Secure Empty Trash to reclaim hard disk space Apps
Ever since I upgraded to 10.3, I have been mysteriously losing hard drive space (this did not happen under 10.2.8). In a typical work day, I will go from 1.1GB of free HD space to less then 300MB, all without adding any files to my system.

I had been resorting to restarting my iBook daily, after which my HD returns to 1.1GB free. I recently discovered that by emptying the trash with the Finder -> Secure Empty Trash menu option, I regain the same amount of space as a restart.

It is only necessary to run the "Secure Empty Trash" option to reclaim disk space, what is in the trash does not matter. Typically I throw away a PDF or create a empty text file to throw away, any size file works.

[robg adds: Testing this hint revealed something else of interest. I had an empty trash can, so I duplicated a PDF and threw it away. Selecting Secure Empty Trash in the Finder, I expected a quick process as the one file was overwritten. Instead, a progress bar appeared, showing 500+ files being securely erased. Based on this experiment, it seems that you can still securely erase files even after emptying them from the trash. I haven't tried to do any low-level work to verify that this is indeed true, but it sure seems like it worked.]
    •    
  • Currently 2.75 / 5
  You rated: 5 / 5 (8 votes cast)
 
[48,002 views]  

10.3: Use Secure Empty Trash to reclaim hard disk space | 26 comments | Create New Account
Click here to return to the '10.3: Use Secure Empty Trash to reclaim hard disk space' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: babbage on Dec 15, '03 11:47:04AM
Testing this hint revealed something else of interest. I had an empty trash can, so I duplicated a PDF and threw it away. Selecting Secure Empty Trash in the Finder, I expected a quick process as the one file was overwritten. Instead, a progress bar appeared, showing 500+ files being securely erased. Based on this experiment, it seems that you can still securely erase files even after emptying them from the trash. I haven't tried to do any low-level work to verify that this is indeed true, but it sure seems like it worked.]

That just makes sense. Pretty much all operating systems "cheat" when you ask them to delete a file: rather than literally removing the contents of that file from the disc, the system sets a flag saying, in effect, "the region of the disc previously occupied by file A2340 is now available for reuse." (Or, more accurately, it just quietly adds that region of the disc into the general pool of space available for writing.)

However, at this point, the only change is that a flag has been set; most or all of the contents of that ex-file are still sitting on the disc's surface, and they will remain there until the system decided to use that space for some other file. This is more efficient than literally wiping out the contents of the old file, and it probably helps extend the lifespan of your disc as well due to less wear & tear.

On the other hand, a "secure delete" feature, no matter what operating system it's implemented for (Panther in this case, but the idea would be the same anywhere), does go and literally purge the contents of deleted parts of the disc. That's why you saw so much activity -- the system was scanning over those 'flagged as available' regions of the disc, no matter how old they were, and actively removing the data from those parts of the disc. The results you saw are more or less exactly the ones that would be expected.

I personally wouldn't rely too heavily on this trick. The extra disc activity involved probably shortens the lifespan of the disc (and all hard drives will fail sooner or later, it's just things like this that help determine whether it'll be later or a lot sooner). Moreover, I just tried it and my disc space available didn't change noticably -- but then most of the time I delete files with the rm command, which may be removing the contents in a way different from the Finder (the rule of thumb with Unix is that you should never assume a deleted file will ever be recoverable without drastic measures, which suggests partly that rm or the system calls it makes are doing a more thorough purge than most systems' (e.g. the Finder, Windows Explorer, etc) delete routines provide.

Interesting trick, but I personally would save it for when you're desperately low on space, or when I actually want to securely delete a file; I don't like putting more stress on my hard drives than necessary, and this hint seems likely to do that.

---
--
DO NOT LEAVE IT IS NOT REAL

[ Reply to This | # ]

10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: simX on Dec 15, '03 06:21:08PM

Your explanation doesn't account for the fact that more hard drive space is being freed after the secure empty trash. The fact that emptying the trash regularly just marks files for reuse doesn't account for the fact that the empty space on the hard drive is increasing after the secure empty trash by an amount LARGER than the size of the files in the trash.

Whether you're securely emptying the trash or emptying it regularly, the operating system still marks all that space as free, so the operating system should free the same amount of space, regardless of whether you use the secure or the regular mechanism. So your explanation just doesn't make sense.

A more likely explanation is that the secure empty trash deletes unused cache files and/or swap files in the system, as one other poster suggested.



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: the1truestripes on Dec 16, '03 09:26:37AM
I personally wouldn't rely too heavily on this trick. The extra disc activity involved probably shortens the lifespan of the disc (and all hard drives will fail sooner or later, it's just things like this that help determine whether it'll be later or a lot sooner).

The primary thing that "ages" hard drives is spinning them down and up, so having a "hard disk sleep time" will wear your drive a lot faster then this. Most of the stuff that gets used when reading/writing the disk is either always going anyway (drive spinning), or all eletronic (read write heads). The only thing you are putting "undue stress" on is the seek motor, and you are not giving it that much of a workout.

This isn't like reving your car up to the red line "because it sounds cool". The wear on the drive is very minor, and probbably less then a lot of other things people do (at least on laptops).

[ Reply to This | # ]

10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: johnsawyercjs on Mar 13, '05 04:41:56AM

If you could KEEP a hard drive spun down for a significant amount of time (a half-hour or longer, to allow it to cool down) when it's not being accessed, that might increase the life of the drive, but if you have only one drive in your Mac, that drive is constantly being accessed while you're using the Mac, so a spindown setting would be pretty useless in that situation since the drive would constantly be spun down and up again, and this might add to the wear and tear caused by a hard drive's main enemy, heat. The Energy Saver prefpane's setting "Put the hard disks to sleep when possible" doesn't let you set how much user inactivity time after which the drive is supposed to spin down, so who knows what figure it uses? If it spins down after only a few minutes of user inactivity, many Macs will spin their drives down and up over and over, as the user pauses or steps away from their Mac for a few minutes throughout the day. I think some third-party utilities let you set the delay before a drive spins down; but if the drive isn't able to stay spun down for more than a half-hour or so at a time, a spindown setting would probably be useless or worse since it wouldn't have time to cool down substantially.

When a hard drive isn't suffering extra wear and tear by being spun down and up constantly, the primary thing that ages a drive is heat, which the drive generates plenty of, due to the friction of its spinning, and makes it more susceptible to the heat generated by the processor chip, which can generate more heat than the hard drive (especially the G5 processor)--the rest of the circuitry in the Mac doesn't tend to generate nearly as much heat. Heat wreaks havoc with everything in the drive--the read/write heads, the drive's controller board, etc. Manufacturers put a heat sink and fan on the computer's processor chip, and some also provide a fan blowing air over the hard drive (some of Apple's designs do), but it might be useful to put a fan right on top of the hard drive (actually about a half-inch above it for clearance/airflow).

You'd think a Mac with more than one drive, in which you're not conciously accessing the secondary drive, would be a candidate for spindown control on the secondary drive, but one problem with the Mac OS (and others?) is that it often looks at volumes that you don't access, when you decide to access another volume, so that if you (or the OS) access a file on one drive, and you have one or more other hard drive mechanisms connected to your Mac that have spun down, OS X will often spin up all attached drives. I don't know why, but it usually makes useless any spindown control settings, unless you're in the habit of often not using your Mac for stretches of a half-hour or longer. Only sleep mode will spin down a hard drive and keep it spun down until you decide to access it (usually). So, with this unfortunate spindown override, having a spindown setting active might actually wear out a drive faster, since it won't be given enough time in a spun-down state to cool off substantially. A drive that's always spinning will probably induce less wear on its bearings, than one that's always spinning down and up again--in fact, these days, a drive that's always spinning will almost always suffer the failure of any other part before its bearing fails.



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: makern on Dec 15, '03 01:04:43PM

I am also experiencing the slow loss of space. I tracked it down to virtual memory & swap files. It seems that Panther handles virtual memory differently than Jaguar and doesn't handle it very well. If you look in /private/var/vm/ you might notice multiple swap files.
This morning I got a warning that I was running out of room on my System partition (only 130MB left; usually about 1.7GB). I checked the vm directory & found 6 swap files: 64MB, 64MB, 128MB, 256MB, 512MB & 512MB.
There are a few threads in some forums about this issue. Doesn't seem to be any way to get rid of them except for restarting.



[ Reply to This | # ]
10.3: Slightly easier (or more effective) way...
Authored by: srobart on Dec 15, '03 03:28:27PM

The easiest way I've found to delete the nasty swap files is to go into the terminal, su to root and type in "rm -rf /private/var/vm/*" (without the " obviously).
I've regained more than a gigabyte of space on my HD by doing that, unfortunately, it must be done every time your computer makes a new swap file. I just leave a terminal window open with the command in the window and hit the up key to recall the command, then hit enter.



[ Reply to This | # ]
10.3: Slightly easier (or more effective) way...
Authored by: babbage on Dec 15, '03 05:02:54PM

Uhh, don't do that. Just don't do that. You're deleting the memory contents of currently running programs. Those vm files aren't just debris, they actively represent data your system is trying to keep track of.

If you want to restrict the growth of VM usage, avoid running many programs simultaneously. If you can do so, try to keep a few GB of disc free so that swap consumption can grow naturally. Or if you want to spend some money, bulk up on RAM &/or get a bigger hard drive. Any of these will help with swap & disc space issues.

The details of Panther handles virtual memory may be different from how it was done in Jaguar & earlier, but the general idea isn't any different from how it has always been: if you are trying to have the system keep track of more data than you have physical memory, it will start swapping data out to swap files. If you have a lot of ram, the ceiling is higher before you start having to swap. If you have a lot of free disc space, you have a more comfortable buffer before problems start coming up.

But if you just start nuking swap files willy nilly, you're just begging for things to start going wrong. Please don't recommend that people do this, it's the wrong way to solve the problem.

(Alternatively, it would be nice if Apple had a utility -- preferably an automatic one -- that tried to reduce the growth of the VM size. This may be something that can be figured out by examining the open source Darwin core, but I've never looked into it. I'd assume that they already do some things to manage VM, but maybe other tools would be useful. However, it is very safe to say that sudo rm /var/vm/* is not a responsible or productive way to go about this.

---
--
DO NOT LEAVE IT IS NOT REAL

[ Reply to This | # ]

10.3: Slightly easier (or more effective) way...
Authored by: ajoakland on Dec 15, '03 11:28:39PM

Actually, this is probably NOT a problem, because, in unix, once a file is open, and it is being accessed, you really don't delete it or free it up until it is closed by the program using it. This is a common unix problem with trying to delete evergrowing log files. Even when you rm the file, you don't regain space until the programing using it closes it. Now I am assuming that a VM file would not be closed until the OS was done with it. Also the fact that the user who did this continued being able to work with no problems, adds some credence to the contents not really being lost.



[ Reply to This | # ]
Trashing swap can have deleterious effects.
Authored by: macmath on Dec 16, '03 03:05:31PM

I was trying out some utility which offered to trash swap. I incorrectly assumed that it would not trash something in use, and let it do so. But it trashed all the swapfiles anyway. The computer locked-up after a bit. The swapfiles should not be trashed by the user. Panther will give back swapfiles itself sometimes, however.



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: SOX on Dec 15, '03 05:18:51PM

This is interesting. note the dates on the swap files:
drwx--x--x 10 root wheel 340 10 Dec 20:17 app_profile
-rw------T 1 root wheel 67108864 10 Dec 18:17 swapfile0
-rw------T 1 root wheel 67108864 10 Dec 19:43 swapfile1
-rw------T 1 root wheel 134217728 13 Dec 16:36 swapfile2
-rw------T 1 root wheel 268435456 14 Dec 14:37 swapfile3

I wonder what the heck is going on. Seems like I should be able to kill a 3 day old swap file.



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: the1truestripes on Dec 16, '03 09:34:17AM
I wonder what the heck is going on. Seems like I should be able to kill a 3 day old swap file.

Depends, have you been running a program for three days? If so it may have "stuff" in there. Even if you havn't it might still be in use. The swap file may have been created three days ago when you were running Word, and then you started Excel two days ago and is put some more stuff in there, then you quit Word, and yesterday you started TextEdit and it used the same swap file, and then you quit Excel, but your three day old swap file still has parts in use by the TextEdit you just started recently...

If it is like any other Unix system I have used though the free space in the swap file will get used for other stuff that needs to swap. Also removing the files won't normally do any harm (a secure delete of them might, but a normal rm or drag to trash and "empty trash" won't) because as others have said Unix doesn't actually delete stuff until the last "reference" to it goes away (it will delete the name from the filesystem, but the contents live on until no process has the file open...and there is some interaction with hard links you probbably don't want to know about).

[ Reply to This | # ]

Later swapfiles have earlier dates?
Authored by: macmath on Dec 16, '03 03:26:24PM

What I find most interesting about the swapfiles in the above post is that later swapfiles have earlier dates. Why is swapfile3 dated before any of the others (unless SOX had successfully deleted swapfile0, swapfile1, swapfile 2 ealier AND the swapfiles which were created thereafter started with swapfile0 again) and why swapfile2 is dated before swapfile0 and swapfile1 (unless that above happened and SOX had successfully deleted the new swapfile0 and swapfile1 again).

SOX, if indeed you did delete these swapfiles without reprocussions, and if the next swapfile created after swapfile0-2 were deleted was called swapfile0, what was the size of the new swapfile0? 64 MB like the original swapfile0 or 512 MB like the swapfile4 would have been had the earlier swapfiles not been deleted.



[ Reply to This | # ]
Later swapfiles have earlier dates?
Authored by: macmath on Dec 16, '03 06:39:08PM

Doh! I guess I can tell from your post that the new swapfile0 and swapfile1 were both 64 MB again! ...but, did you delete successfully those original swapfiles and get them replaced by a new swapfile0 and swapfile1, etc. or what is the explanation of the dates being out of order?



[ Reply to This | # ]
Later swapfiles have earlier dates?
Authored by: johnsawyercjs on Mar 13, '05 03:45:21AM

I'm not sure how you perceive that the swapfiles listed in SOX's post are in reverse chronological order:
10 Dec 18:17 swapfile0
10 Dec 19:43 swapfile1
13 Dec 16:36 swapfile2
14 Dec 14:37 swapfile3

Swapfile0, created first, is shown as being created earlier (10 Dec) than the other swapfiles (with swapfile1 created later the same day), and so on through swapfile3. Last time I looked, Dec 13 and Dec 14 came after Dec 10.



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: macmath on Dec 16, '03 03:10:38PM

Panther will give back swapfiles. Particularly if you log out and back in immediately after some heavy usage. Logging out after some heavy usage (and after some swapfiles have recently been created) will quit as many processes as possible. Waiting a few moments and then logging back in will show that some swap has probably been released by the OS. Pather will give back some swap even without logging out, but the maximum swapspace will likely be returned if as much activity is killed as quickly as is reasonably possible after the swapfiles have been created. Try it!



[ Reply to This | # ]
Panther does give back swap without a restart.
Authored by: macmath on Dec 16, '03 03:19:38PM

The above post of mine should read "Pather does give back swap without a restart. I apologize for this extra post, but I wanted to make sure that the point of the post was clear.



[ Reply to This | # ]
Default is for swapfile sizes to double after swapfile1
Authored by: macmath on Dec 16, '03 03:29:49PM

From makern's above post
<i> checked the vm directory & found 6 swap files: 64MB, 64MB, 128MB, 256MB, 512MB & 512MB. </i>

Actually, the 6th swapfile should be 1024 MB, as the size of each new file is the sum of the sizes of all of the earlier swapfiles. Said another way, starting with swapfile2, the size of each swapfile is double the size of the previous swapfile.



[ Reply to This | # ]
More likely explanation
Authored by: Dan B on Dec 15, '03 02:31:04PM

It's more likely that Secure Empty Trash delete many of the files in Library/Caches, since these potentially contain traces of information you were working on. I find it less likely that the reclaimed space come from files you've previously deleted.



[ Reply to This | # ]
More likely explanation
Authored by: babbage on Dec 15, '03 05:07:02PM

Interesting observation -- makes sense. Still, there's no reason it couldn't be a combination of both purging stray caches & overwriting regions of the disc as well: it seems to me that a "secure" delete routine should also make an attempt to scrub the disc contents, as there are forensics techniques for recovering the contents of deleted files.

---
--
DO NOT LEAVE IT IS NOT REAL

[ Reply to This | # ]

More likely explanation
Authored by: wpdv on Dec 17, '03 11:51:58AM

What I have read about Secure Empty Trash, is that it completely overwrites all of the data that you have in the trash, with 0's and 1's. I think I read this in Apple's help area. I hope this helps. :)



[ Reply to This | # ]
More likely explanation
Authored by: wpdv on Dec 17, '03 11:57:37AM

I just copied this from Mac Help:

Deleting files and folders

You can delete files and folders on your disk that you no longer need.

1. Drag the items to the Trash (at the end of the Dock).

Any files or folders you drag to the Trash remain there until you empty the Trash. If you change your mind about something, you can still retrieve it from the Trash if you haven't emptied it yet. Click the Trash icon to open the Trash window, then drag items back to your home folder.

2. Choose Finder > Empty Trash.

Even after emptying the trash, deleted files may still be recovered by using special data-recovery software. To delete files so that they cannot be recovered, choose Finder > Secure Empty Trash. Files deleted in this way are completely overwritten by meaningless data. This may take some time, depending on the size of the file. You may want to use Secure Empty Trash if you sell or give away your computer.

If an item is locked, you cannot put it in the Trash. Select the item and choose File > Get Info, then deselect the Locked checkbox in the General pane. If you do not own the item, you may need to provide an administrator's name and password to put the item in the Trash.

Press the Option key when you choose Empty Trash to prevent the warning message from appearing. You can also turn off the warning in the Advanced pane of Finder preferences.



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: jaydisc on Dec 15, '03 05:43:22PM

I think all of these assumptions are incorrect. When you delete invisible items, you trash can does not show the full icon, and Empty Trash/Empty Secure Trash commands are unavailable. I think either packages or invisible items have been deleted before you attmempted this exercise, and therefore, it must write seven passes of random data over EACH piece of the package and/or each invisible file.



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: jamiefiedler on Dec 15, '03 05:48:12PM

i'm going to guess maybe secure delete rebuilds directory & file system related database files & rewrites over their old sectors as well as the actual deleted files, to remove any file system links that may contain filenames, sizes, creation/modification dates, finder comments, etc. this rebuild may somehow save/reclaim space when being performed...

this is all just guessing...i have no technical information to back this up whatsoever!



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: johnsawyercjs on Mar 13, '05 03:51:12AM

Well, your theory is more likely than one proposed above, that secure delete trashes cache files, since secure delete just writes over and deletes things that are in the Trash, and cache files that aren't in the Trash, are just that--they're not in the Trash, and so they stay put until you drag them there, or OS X deletes them, so emptying the Trash in any fashion shouldn't delete cache files that aren't in the Trash.



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: ether on Dec 18, '03 08:36:20PM

Strangely enough, when I tried Secure Empty Trash, my freespace went from 2.11G to 1.87G. I have noticed this
paradoxical effect before with normal trash emptying, too,
under (at least) 10.2.6 thru 10.3.1



[ Reply to This | # ]
10.3: Use Secure Empty Trash to reclaim hard disk space
Authored by: MASCARNHAS on Jun 20, '10 01:05:34PM

I've used Report and although its great, I've had better luck with WheresTheFreeSpace. It is Modeled after a PC application that is very popular called <a href="http://www.wheresthefreespace.com">Treesize (but its for Mac).</a>



[ Reply to This | # ]