Lost internal SSD gigs

Hi guys, I'm new to MacOS (since November 2017) and ran into a problem I can't seem to figure out. About a week ago I went from 150 gb free to 28 gb free and don't know what caused it. The last program I installed (around the same time is called TouchRetouch. My TM backup is to an external HD. Could some of the TM backup stored something on internal SSD? What's the best way to identify what's causing the problem? Also, I have a CCC image backup that's less than a month old. If I restore that will it erase my current SSD and reclaim my space? I have a 2017 MacBook Pro (Touch Bar) running High Sierra.

What do the TM and CCC logs say about the last things they did???

Is your backup drive actually connected and running/mounted???

If I restore that will it erase my current SSD and reclaim my space?

Click to expand...

Possibly and probably but you'd also probably loose any data you've created in the interim since the last CCC backup. Personally I'd use a different method i.e.: see above comments.




- Patrick
======

Can you tell me how to find the log files? I woke up to 5.9 gb free today! My TM drive is always connected and mounted. My CCC drive is bootable clone of a good state and is not mounted or connected. I don't know if this is relevant, but I try to keep as many programs as I can on an external SSD. I'm hoping if you can help me find the log files it'll explain what's going on. Thank you for your help.

A minor point, possibly, but as you have a Notebook, Time Machine backups are initially stored as snapshots until you attach your TM External Hard Drive at which point they are integrated with TM proper.

This is often an explanation for a reduction in storage capacity. That storage is reclaimed after attaching the TM EHD. May not be the answer in your case, I concede; but worth a reminder.

It's easy to find out how much space the TouchRetouch app is using, but I doubt that's the culprit.

Ian

Do you know where they are stored on my internal drive? Is it possible something got stuck?

Open Terminal.

Enter this command exactly as typed here:

tmutil listlocalsnapshots /

The result will be all of the local snapshots Time Machine has taken since the last time the backup drive was attached. If there are many, that could be the place the space has gone. If there are just two, that's is NOT the problem.

And I read somewhere that the space reported as being taken by snapshots is actually purgeable, which means it will be recovered and re-used if there is a "real" need for space on the drive. Not all applications know what to do with purgeable space, so you get strange reports of free space.

MacInWin said:

Open Terminal.

Enter this command exactly as typed here:

tmutil listlocalsnapshots /

The result will be all of the local snapshots Time Machine has taken since the last time the backup drive was attached. If there are many, that could be the place the space has gone. If there are just two, that's is NOT the problem.

Click to expand...

There's only one file, dated today. So I guess that's not the problem. I suspect I'm going to have to restore my CCC backup but I would love to solve it, that's how I learn!

And one more thought: TouchRetouch is an image editing tool. Images are large files. If you are doing a lot of retouching on a lot of files and if TM is on, then each backup will have lots of images stored, which could make the snapshots larger looking that might otherwise be. TM is supposed to manage the snapshots when the backup drive is reattached to the Mac, but if the backup drive isn't attached long enough for TM to complete the backups, then the snapshots just accumulate. What I would do is attach the backup drive and observe the TM icon and/or the Activity Monitor Drive tab to see that the backup is actually running and leave the drive attached until it is complete and drive activity goes back down. Then see if you got your space back.

Ah, we cross posted. OK, one snapshot only eliminates Time Machine as the culprit. Do you leave your system on overnight? There is a cleaning routine that macOS runs at night that purges some cache and storage. You can try leaving it on overnight to see if space comes back.

Also, you can get OnyX from titanium.free.fr (it's free) and leaving exactly as the developer set it, run the maintenance routine and clean out cache and other areas that can accumulate "stuff" you don't really need. Get the OnyX version for YOUR system, as the versions are unique to individual OSes.

I leave my MBP on 24/7 with occasional reboots any my TM Backup is also always connected. It's CCC that I make a clone monthly and then store away. I'm going to give OnyX a try since I've been reading a lot about it on the forum. I'll report back after running it.

OnyX gave me back only about 6 gbs. I'm back to 12.67 gb free.

Ramer84015 said:

There's only one file, dated today. So I guess that's not the problem. I suspect I'm going to have to restore my CCC backup but I would love to solve it, that's how I learn!

Click to expand...

I'd agree and I'd suggest using some of these and do some checking and maybe some cleaning:
Grand Perspective
http://grandperspectiv.sourceforge.net
or
Disk Inventory X
http://www.derlien.com

And to seek and destroy if needed or to just find: (Also good for finding stuff over a certain size or after some added date.)
Find Any File (FAF)
http://apps.tempel.org/FindAnyFile/

PS: The CCC log file should be available from its menu and TM (I don't bother using it) should have the info of when last run etc in its System Prefs window.

PPS: Be aware that CCC can also have a "Safety net" that can take up a lot of space and TM has the "snapshot" thing that has been mentioned. I would suspect it!!!




- Patrick
======

pm-r said:

I'd agree and I'd suggest using some of these and do some checking and maybe some cleaning:
Grand Perspective
http://grandperspectiv.sourceforge.net
or
Disk Inventory X
http://www.derlien.com

And to seek and destroy if needed or to just find: (Also good for finding stuff over a certain size or after some added date.)
Find Any File (FAF)
http://apps.tempel.org/FindAnyFile/

PS: The CCC log file should be available from its menu and TM (I don't bother using it) should have the info of when last run etc in its System Prefs window.

PPS: Be aware that CCC can also have a "Safety net" that can take up a lot of space and TM has the "snapshot" thing that has been mentioned. I would suspect it!!!




- Patrick
======

Click to expand...

I agree about TM, I didn't really see the need as long as I have CCC. I just got out my CCC backup and was going to get started with my restore, but I'll over the links you sent me first. Thank you for your help today.

I agree about TM, I didn't really see the need as long as I have CCC.

Click to expand...

That's just my opinion for my usage, but TM can be useful for some or many users, as long as it works properly.

Unfortunately, I guess I've just seen it fail too often on some users Macs to recommend it, especially as the ONLY backup used!!! I'd suggest NO for that.

PS: I'd sure try some of my suggestions in my #13 post before using a one month old CCC backup restore!!! But your choice…





- Patrick
======

pm-r said:

Unfortunately, I guess I've just seen it fail too often on some users Macs to recommend it, especially as the ONLY backup used!!! I'd suggest NO for that.

Click to expand...

I wonder what the ratio, of total users, that it just works for, compared to the times it's failed?

Patrick, thank you again for your help today. Grand Perspective and Find Any File helped me find the culprit. It was ESET Anti-Virus. I regained 170 gigs back. I still have some files that won't delete via the trash can. Do you have any tricks to remove the remaining problems with the word ESET in their filename or folder?

Restart and try again? Also, removing ESET, would go a long way to making sure this issue doesn't happen again. Especially because Anti-Virus software is not needed.

ferrarr said:

Restart and try again? Also, removing ESET, would go a long way to making sure this issue doesn't happen again. Especially because Anti-Virus software is not needed.

Click to expand...

I know, it's Windows in me that made me install it. Anyway, I was able to clear it all out by using the app itself to uninstall it and reboot. I've been mulling over this for about a week, so glad to have my MBP back under control. I'm retired and got it just to have something new to keep my brain cells functioning!! Got a workout today, lol.

I still have some files that won't delete via the trash can. Do you have any tricks to remove the remaining problems with the word ESET in their filename or folder?

Click to expand...

You can try this when using Find Any File on anyname file/folder related to any ESET stuff.

In FAF, enter your search phrase and then hold the option key when you click the Find button, then enter your user password in the permissions window and you'll end up as root user for the selected FAF operations.

In the list of found items when you select one or a selected bunch of things, then use a right-click and select "Delete Immediately". They should just go poof — gone!!!

But if any were still "active", you'll need to shutdown, wait 30-40 seconds and then boot up and then empty the trash if there are any things left to delete.

You may then need to check for any other still remaining ESET related stuff and repeat the removal procedure again.

I hope this makes sense.




- Patrick
======