After upgrading to MacOS Catalina, I have a Relocated Items folder on my Desktop. Inside this folder is a PDF explaining what these items are.

Inside the folder are two sub-folders - Configuration and Security. These folders contain items that were in locations which are no longer compatible with the new macOS configuration. You are advised to review the items in these directories and take appropriate action.

The problem is that within the Security/usr folder is a symbolic link called X11 pointing to /opt/X11. The /opt/X11 directory does not exist and I cannot remove the X11 link with either unlink or rm (as sudo and have tried after sudo su to get a root shell). When I try to remove the file, I get "Operation not permitted". I can move the link to the Trash, but when I do, trying to empty Trash results in an error saying it cannot be emptied because X11 is a file required by macOS. So, how do I get rid of this link?

Update: I also noted that xattr shows nothing.

  • 1
    Hi Tim, please have a read through this article: osxdaily.com/2018/10/09/… Although it is concerted with MacOS Mojave, you will find this should assist you in removing that folder. Also use the sudo rm -rf command to remove that symlink. – Danijel-James W Oct 9 '19 at 1:21
  • 1
    @Danijel-JamesW Thanks, but sudo rm -rf doesn't help, just gives the same error. – Tim X Oct 9 '19 at 1:41
  • Also verified the terminal app has full disk access, so that is not the issue. Looks like I may need to delve into turning off SIP and see if that works – Tim X Oct 9 '19 at 1:52
  • 3
    You do not need to disable SIP, but you do need to boot to the Recovery OS and delete it in Terminal from there, e.g.: rm -r /Volumes/Macintosh\ HD\ -\ Data/Users/[short_user_name]/Desktop/Relocated\ Items – user3439894 Oct 9 '19 at 2:32
  • 2
    I didn’t feel like venturing to the Recovery OS, so I just sudo mv Relocated\ Items /tmp. Out of sight, out of mind, as they say. – Fls'Zen Oct 11 '19 at 0:01

As this questi9on has had over 1k views, it seems it is a common issue. Therefore, I thought I would outline what I did to get it resolved in case others find it useful.

When I first tried to remove the link, I was told the operation was not permitted. Looking at the link, I could see it was owned by 'root' and in the 'wheel' group. I therefore then tried to remove it with sudo i.e.

sudo unlink X11

This failed with the same error. I also tried

sudo rm -rf X11

but this also failed with the same error. I then posted here asking for help and @Danijel-JamesW added a comment with a link to a useful article which provided some background on the new security features initially introduced in the previous version of macOS, but extended in Catalina. One of the things this article highlights is that some applications, like terminals and editors (in my case Emacs), need to have the full disk access privilege. Without this privilege, you will often get operation not permitted errors in unexpected locations/situations. Unfortunately, this was not the issue in my case. My terminal app (iTerm2.app) had the necessary permissions. However, the article did indicate that you could also get around the operation not permitted error by disabling SIP (System Integrity Protection). This was going to be my next move. However, in the end it was not necessary.

Thanks to a comment from @user3439694 I found out that you can boot into recovery mode and use the terminal to delete the file. THis is what I did

  1. Boot holding down commmand + R
  2. Click on Utilities and select Terminal from the top menu
  3. Enter rm -rf /path/to/file/to/remove
  4. Reboot

This solved my issue. One important thing to note is that working in the recovery terminal is powerful and potentially dangerous. You need to make sure you are deleting what you mean to delete. To be extra safe, instead of immediately issue the rm command, you can use ls -l to make sure you have the correct file or directory and then hit the up arrow to bring back the command from the history, move to the beginning of the line, remove the ls -l and type rm -rf, leaving the path unmodified following the rm -rf. Note also that the -r means recursive and -f means force - very powerful and dangerous. It will essentially remove everything from the point specified in the path downwards i.e. all sub directories and files. So, if you get that path wrong, you may end up deleting much more than you expected to. In my case, the path I needed was

/Volumes/Macintosh\ HD\ -\ Data/Users/tim/Desktop/Relocated\ Items

my login account is 'tim'. the '\ ' are needed to escape the spaces in the path. Most systems will have the path starting with /Volume, but the drive name may differ (i.e. Macintosh HD). the '- Data' is fairly standard.

Anyway, this fixed the issue and those irritating files are now gone and my Desktop folder is clean (for now!).

  • After booting into Recovery Mode, the data volume wasn't available in /Volumes. I had to open Disk Utility and explicitly mount it (took a while to prompt for a password) before being able to cd into it and delete the file. – David Lord Oct 27 '19 at 0:30
  • Also, if you already moved the folder to the bin, it'll be in .Trash in your user folder rather than eg Desktop. – David Lord Oct 27 '19 at 0:31
  • You may have a non-standard disk setup. I've now fixed this issue on 4 different systems and while the path may differ depending on the name given to the partition when originally installed, there was no need to manually mount the disk. Perhaps your /Users is on a separate physical disk rather than a separate partition? – Tim X Oct 28 '19 at 1:15
  • Guessing it might be from disk encryption on my simple MBP setup (with a single disk). The - Data volume seems to be part of the System and Data volume separation in Catalina, but dunno why it auto-mounts on some systems but not others. Hey, at least it still all works ¯\_(ツ)_/¯ – David Lord Oct 29 '19 at 4:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .