200GB lost on APFS boot disk

Question

Recently (last month) I upgraded from Sierra to High Sierra on one of my Macs. I now am confronted with 200GB of the 500GB 'lost'. That is, when running OmniDiskSweeper as root, I find 255GB files, but according to df, 460GB is in use. Removing large files (e.g. I removed a 33GB directory with rm) does not increase free space. I've run repair on the volume (system in target disk mode, repair executed from another Mac).

The disk was full yesterday (unexepected) and the system died. What pushed it over the edge was CrashPlan crashing and writing 12.5GB cores. I used the string command to try to find where the core dumps came from but string gave errors like "malformed object LC_SEGMENT_64 fileoff field plus filesize extends past the end of the file". That sounded like file system corruption to me, hence the attempt to repair.

I first tried to remove those core dumps to free up data, and that worked to give me 40GB. But I removed more from the disk and I never got that space back. Not even the repair gave me my disk space back. I now have a file system with 210GB space missing.

I cannot use DiskWarrior as it doesn't handle APFS. So, what can I do?

Answer 1

The reasons for this problem were twofold, it has turned out.

1. About half of the missing space was in SIP-protected folders that are not found by programs like du or OmniDiskSweeper, not even when they are run as root. A safe boot fixed that.
2. The other half was indeed (see How to thin your local Time Machine Snapshots on macOS High Sierra mentioned in a comment to my question) in time machine local snapshots.

The LC_SEGMENT error may have been a red herring. Checking the APFS system with the machine in TDM attached to another Mac did not notice any problems with the file system.

Time Machine does provide a risk for boot file systems that are pretty full and that have a volatile content (large size of additions and removals). And these days, you cannot turn local snapshots off anymore.