df -h Filesystem Size Used Avail Use% Mounted on /dev/disk2s1 233G 215G 18G 93% / /dev/disk2s4 233G 20K 18G 1% /private/var/vm
sudo du -xhd 1 / 0 /.HFS+ Private Directory Data 4.1G /usr 913M /.Spotlight-V100 0 /.PKInstallSandboxManager-SystemSoftware 2.7M /bin 0 /Network 1.2M /sbin 3.8G /Library 7.3G /System 1.8M /.fseventsd 5.4G /private 1.1G /.DocumentRevisions-V100 0 /.vol 19G /Users 18G /Applications 177M /opt 0 /Volumes 0 /cores 59G /
This simply does not add up. I'm not able to understand where those 196GB come from...
diskutil to ckeck for errors:
Verifying file system. Volume could not be unmounted. Using live mode. Performing fsck_apfs -n -l -x /dev/rdisk2s1 Checking volume. Checking the container superblock. Checking the EFI jumpstart record. Checking the space manager. Checking the object map. Checking the APFS volume superblock. Checking the object map. Checking the fsroot tree. Checking the snapshot metadata tree. error: btn:1: invalid key order (1) oid 631545 / oxid 288900 Snapshot metadata tree is invalid. The volume /dev/rdisk2s1 could not be verified completely. File system check exit code is 0. Restoring the original state found as mounted. Operation successful.
The test passes but there is an error
Snapshot metadata tree is invalid. which googling relates to Timemachine, which I never used, just to be sure run
tmutil listlocalsnapshots / which outputs nothing.
Any ideas how to track what's messing with the disk?