I had a very unusual problem recently with a client – his MacBook Pro running Catalina was constantly running out of disk space.

He let it slide for a while, and then started to prune his data when space got really low – things like deleting 26 GB from Documents/Microsoft User Data with an old Outlook 2011 profile, but no matter what he did, the free space kept reducing.

As it turns out, with Catalina there is some powerful juju going on behind the scenes and what you see is not always what is actually happening. Files can show a size, but be taking up a different amount of space on disk. Partitions share space dynamically with other partitions. Copy-on-write means multiple copies of a file don’t necessarily take up space until they’re written to. Snapshots can take up significant amounts of space, and free space may not increase when deleting files…

There were two unusual things going on with this MacBook Pro. The first was able to be identified by running a utility like WhatSize to find big files on the disk. This identified a massive file in /System/Library/Caches/com.apple.coresymbolicationd/ that was named data and it was over 100 GB in size. As this location is a cache, so shouldn’t contain any critical data, I went ahead and deleted it – and the free space on the disk didn’t change at all.

Then I had to start digging a lot deeper to see what else could be going on. Poking around with diskutil showed that there was a VM partition taking up 273 GB – more than half the disk. This was really strange as looking in /private/var/vm showed one sleepimage file and two swapfiles, taking up a total of 3 GB.

 diskutil list
/dev/disk0 (internal, physical):
    #:                       TYPE NAME                    SIZE       IDENTIFIER
    0:      GUID_partition_scheme                        *500.3 GB   disk0
    1:                        EFI EFI                     209.7 MB   disk0s1
    2:                 Apple_APFS Container disk1         499.9 GB   disk0s2
 /dev/disk1 (synthesized):
    #:                       TYPE NAME                    SIZE       IDENTIFIER
    0:      APFS Container Scheme -                      +499.9 GB   disk1
                                  Physical Store disk0s2
    1:                APFS Volume Macintosh HD — Data     213.6 GB   disk1s1
    2:                APFS Volume Preboot                 81.1 MB    disk1s2
    3:                APFS Volume Recovery                528.6 MB   disk1s3
    4:                APFS Volume VM                      273.6 GB   disk1s4
    5:                APFS Volume Macintosh HD            10.9 GB    disk1s5

I couldn’t do anything with this partition while booted into macOS, so I booted into Recovery mode, wiped the VM partition and recreated it again.

From diskutil list, I could see that the VM partition was /dev/disk1s4, so to erase it I used diskutil again:

diskutil apfs eraseVolume disk1s4 -name VM

Then, I had to set it back to the correct role, so diskutil apfs list showed me the partitions and their IDs

diskutil apfs list
...
+-> Volume disk1s4 4A8675D8-8109-48DE-9CB0-D3AC7CA1AE4D
...

Next to set it back to the correct role (VM)

diskutil apfs chrole 4A8675D8-8109-48DE-9CB0-D3AC7CA1AE4D V

Finally, I could use diskutil apfs list once more to check it’s role had updates

+-> Volume disk1s4 4A8675D8-8109-48DE-9CB0-D3AC7CA1AE4D
|   ---------------------------------------------------
|   APFS Volume Disk (Role):   disk1s4 (VM)
|   Name:                      VM (Case-insensitive)
|   Mount Point:               /private/var/vm

At this point I rebooted back into macOS and verified that there was an extra 270 GB of free space on the disk.