How to permanently delete folders from /var/folders/ situated in Trash

high sierrapermissionrecoveryterminaltrash

I recently encountered an error where none of the applications would open, similar to this. I was able to resolve the issue by using Go to Folder... option under the Go menu and navigating to /var/folders/. I deleted all the folders there and rebooted my system, after which everything is working normally.

The problem now that I'm unable to permanently delete the folders fz and sv from Trash. When I try to delete them, I get the following warning and no matter what I select, the folders are not deleted from Trash – The operation can’t be completed because the item “0” is in use.

Note – MacOS has already replaced these deleted folders in /var/folders/.

I've also tried deleting it from the terminal with super user permissions but still can't delete them –

Anish@Anishs-MBP:.Trash $ sudo rm -rf *
Password:
rm: fz/w4_v47p50v141vqr9pwtg9qc0000gp/0/SafariFamily: Operation not permitted
rm: fz/w4_v47p50v141vqr9pwtg9qc0000gp/0/com.apple.LaunchServices.dv: Operation not permitted
rm: fz/w4_v47p50v141vqr9pwtg9qc0000gp/0/com.apple.nsurlsessiond: Operation not permitted
rm: fz/w4_v47p50v141vqr9pwtg9qc0000gp/0/com.apple.routined: Operation not permitted
rm: fz/w4_v47p50v141vqr9pwtg9qc0000gp/0: Directory not empty
rm: fz/w4_v47p50v141vqr9pwtg9qc0000gp: Directory not empty
rm: fz: Directory not empty
rm: sv/tjz3fg0j3hx5_lhhmv335s0m0000gn/0/com.apple.LaunchServices.dv: Operation not permitted
rm: sv/tjz3fg0j3hx5_lhhmv335s0m0000gn/0/com.apple.nsurlsessiond: Operation not permitted
rm: sv/tjz3fg0j3hx5_lhhmv335s0m0000gn/0/com.apple.routined: Operation not permitted
rm: sv/tjz3fg0j3hx5_lhhmv335s0m0000gn/0: Directory not empty
rm: sv/tjz3fg0j3hx5_lhhmv335s0m0000gn: Directory not empty
rm: sv: Directory not empty

I've also rebooted the system in Safe Mode and tried to delete them but no luck.

I realize that there are operations being run tied with these files that's causing the problem. How do I find and stop these tasks so that I can delete these folders?

This issue is only with a single user account. It looks like I'll have to disable System Integrity Protection and then try to delete them. Is that safe? I'm using High Sierra if that matters.

Any help would be greatly appreciated.

Best Answer

If you can’t delete the file because a process is holding it open you could try killing the process and then deleting the file. To find the process try the command below

lsof | grep [path_to_file]

Then kill each process by ID with

kill -9 [id]

For lsof to give you the PIDs the file must be open when lsof is actually executing. If it’s being opened and closed extremely quickly by one or more processes then this approach may not work

There’s another way that’s more OSX friendly/specific which is the following command

sudo fs_usage | grep [path_to_file]
Related Question