Apple Genius steals precious drive space

The other day I reported on my issues with a faulty SD card reader.  A couple of support forum users had success in having the logic board replaced so I made an appointment with an Apple Genius.  My assigned Genius, Taylor, was great to work with.  He was very friendly and although he had never seen this particular issue before, he completed the troubleshooting without fail.  Even though it was the morning of Christmas Eve, and I’m sure they had a long day ahead of them, he was patient with me while we discussed the problem and came up with a repair schedule that worked for me.  This post isn’t about how great they are so let me get into the problem.

During the troubleshooting, Taylor plugged my laptop into their network and booted an OS X image from their NetBoot server.  He tested the SD card reader with his SD card so that he was able to reproduce the problem with a known, good environment.  This only took a few minutes and when he was finished, he shutdown the laptop.

This morning I noticed that my CrashPlan backup was running which is rare as it normally finishes everything during the night.  I looked at what CrashPlan was uploading and was surprised to see it was pushing up a 16GB sleepimage file.  Normally the backup of the hibernation/sleep image file is skipped by CrashPlan per their global exclusion rules.  I discovered that it was uploading the file located on my secondary hard drive at /Volumes/HDD/  This is odd for a few reasons.

My laptop’s power manager settings, which are saved in NVRAM, is configured to save the sleepimage file on the SSD at /private/var/vm/

It is also configured to only create the sleep image when actually sleeping.  During the troubleshooting, the laptop was never put to sleep but only a normal boot up and down.  I guess it is possible that their boot image would override the laptop’s PM settings but they are back to my settings now.  Perhaps this is a required mode when using a network booted system.

My primary drive (OS, Applications, User folder), in the main drive bay, is an SSD.  It has plenty of space left.  I don’t know why their boot image decided to use the secondary HDD for the sleepimage file instead.


There are a couple of items to note here that might make it difficult for some users.

Since the directory starts with a period, it is hidden in the Finder, so you can’t just drag it to the trash.

The directory, and all files inside, are owned and only readable/writable by the root user.

Due to these items, most users will never notice the directory.  Depending on how full your drive is, you might not even notice that you have lost the space.  In my case, I don’t have much free space left so an additional 16GBs would be noticed soon enough.  The size of the sleepimage file will be the same as how much RAM you have installed in your machine.  If you only have 4GB of RAM, but a 1TB hard drive, you probably won’t even notice or care about the lost space.


If you have ever been to the Apple Genius Bar, and they network booted your computer, you might want to check for the existence of the NetBootX directory.

  1. Open up the Terminal application (located in /Applications/Utilities folder)
  2. Get a full directory listing of the top level of your hard drive, with the command
    ls -al /

    If you have a secondary drive, check it too with

    ls -al /Volumes/[2nd drive name]/

    The listing output will look similar to this.

    $ ls -al /
    drwxr-xr-x   33 root  wheel     1190 Dec 26 13:20 ./
    drwxr-xr-x   33 root  wheel     1190 Dec 26 13:20 ../
    d--x--x--x    8 root  wheel      272 Aug 25 13:04 .DocumentRevisions-V100/
    drwx------    5 user  staff      170 Aug 23 16:05 .Spotlight-V100/
    d-wx-wx-wt    3 user  staff      102 Dec 26 16:25 .Trashes/
    drwx------    5 root  wheel      170 Dec 24 11:24
    drwx------   69 user  staff     2346 Dec 26 12:37 .fseventsd/
    drwxr-xr-x@   2 root  wheel       68 Jun 20  2012 .vol/
    drwxrwxr-x+ 139 root  admin     4726 Dec 25 12:57 Applications/
    drwxr-xr-x+  68 root  wheel     2312 Nov  7 22:36 Library/
    drwxr-xr-x+   4 root  wheel      136 Jul 26 01:48 System/
    drwxr-xr-x    7 root  admin      238 Aug 20 14:54 Users/
    drwxrwxrwt@   6 root  admin      204 Dec 26 15:24 Volumes/
    drwxr-xr-x@  39 root  wheel     1326 Sep 19 15:41 bin/
    dr-xr-xr-x    3 root  wheel     4709 Dec 25 10:52 dev/
    lrwxr-xr-x@   1 root  wheel       11 Aug 23 19:39 etc@ -> private/etc
    -rw-r--r--@   1 root  wheel  8192160 Aug 25 01:49 mach_kernel
    drwxr-xr-x@   6 root  wheel      204 Jul 26 01:57 private/
    drwxr-xr-x@  62 root  wheel     2108 Sep 19 15:41 sbin/
    lrwxr-xr-x@   1 root  wheel       11 Aug 23 19:39 tmp@ -> private/tmp
    drwxr-xr-x@  13 root  wheel      442 Oct  2 22:01 usr/
    lrwxr-xr-x@   1 root  wheel       11 Aug 23 19:39 var@ -> private/var

    If you are curious to see the size of the files, list the directory with

    $ ls -al / 
    drwxr-xr-x@  5 root  wheel          170 Dec 24 11:24 ./
    drwxr-x--x  30 user  staff         1088 Dec 26 13:10 ../
    -rw-r--r--@  1 root  staff    216169984 Dec 24 11:31 shadowfile
    -rw-r--r--@  1 root  staff  17179869184 Dec 24 11:24 sleepimage
    -rw-r--r--@  1 root  wheel     67108864 Dec 24 11:24 swapfile0

    The size of the other files are only a few hundred megabytes, which is minor compared to the sleep image.

  3. If you do have the directory, you can remove it with the following command.  WARNING: Running “sudo rm” with the wrong arguments could delete all your files.  Be very careful with this command.  Make sure there is NOT a space between the / and .com….
    sudo /bin/rm -ri /

    If it is on your secondary drive, the command will be

    sudo /bin/rm -ri /Volumes/[2nd drive name]/


You should now be clean of the Genius’ files and the drive space will be available again.  If you ever take your system in again, don’t forget to check for the NetBootX directory when you get it back.

This entry was posted in Tips, Tricks and Hacks. Bookmark the permalink.