I have a MacBook Air 11" running OS X 10.8.5. I have a 128GB SSD drive that was running out of space with only 10 GBs free. The largest single file on the filesysem was my 30+ GB Windows 7 virtual machine that I run in Parallels Desktop 7. I moved the file to an external USB drive (the virtual machine was not running during the move), and deleted the source file on my Mac's internal SSD. However, I did not reclaim the 30+ GBs of space. I reclaimed just a little over 1GB.

I then ran df -h which shows the following:

filesystem                          Size   Used  Avail Capacity  iused   ifree %iused  Mounted on
/dev/disk0s2                       112Gi  101Gi   11Gi    91% 26612595 2799773   90%   /
devfs                              190Ki  190Ki    0Bi   100%      656       0  100%   /dev
map -hosts                           0Bi    0Bi    0Bi   100%        0       0  100%   /net
map auto_home                        0Bi    0Bi    0Bi   100%        0       0  100%   /home
localhost:/gLd8Xi-KfPSbPCbN1RG-Js  112Gi  112Gi    0Bi   100%        0       0  100%   /Volumes/MobileBackups

I then ran sudo lsof | grep -i deleted which shows the following:

Microsoft 1101         wesley  txt       REG                1,2      27324            15737160 /Applications/Microsoft Office 2011/Microsoft Outlook.app/Contents/Resources/[email protected]
Microsoft 1101         wesley  txt       REG                1,2       4444              768068 /Applications/Microsoft Office 2011/Microsoft Outlook.app/Contents/Resources/navigation.DeletedItems.tif

...okay so I've got some files marked for deletion, but they're certainly not tens of GBs and that still doesn't explain why after deleting a 30+ GB virtual machine image the space was not released.

sudo du -sh /* shows the following:

7.4G    /Applications
 22G    /Library
  0B    /Network
4.7G    /System
4.0K    /User Information
 23G    /Users
9.2G    /Volumes
3.1M    /bin
  0B    /cores
4.5K    /dev
4.0K    /etc
1.0K    /home
7.9M    /mach_kernel
1.0K    /net
286M    /opt
9.6G    /private
1.6M    /sbin
4.0K    /tmp
472M    /usr
4.0K    /var

Added up, that's 76GB used, not the 101GB used that df shows. Strangely, that doesn't really add up to the 30+ GB file that was deleted. I can't find correlating numbers to the deletion of that large file.

Oddly, sudo du -sh / shows 102G / in contrast to the added numbers shown by du -sh /* showing 76 GB.

A storage report shows the following:

Why did I not reclaim the tens of GBs that the single large file took up? How can I reclaim it and are any of the various disk usage numbers that aren't adding up a sign of a larger problem?

EDIT 1

I searched for every file roughly 1GB or larger (sudo find / -type f -size +1000000k -exec ls -sd {} +) and don't see anything out of the ordinary. A ~15GB crashplan cached index and my sleepimage. No 30GB virtual hard drive.

15189712 /Library/Caches/CrashPlan/42/cpfmf
 4642008 /Library/Caches/CrashPlan/42/cpfmfp
 2298832 /Library/Caches/CrashPlan/42/cpfmfx
 7704432 /Library/Caches/CrashPlan/42/cphdf
 2754832 /Library/Caches/com.apple.coresymbolicationd/data
 2304144 /Library/Logs/CrashPlan/engine_output.log
 2482240 /System/Library/Caches/com.apple.coresymbolicationd/data
 2026472 /Users/wesley/Library/iTunes/iPhone Software Updates/iPhone5,1_6.1.4_10B350_Restore.ipsw
 2025832 /Users/wesley/Library/iTunes/iPhone Software Updates/iPhone5,1_6.1_10B143_Restore.ipsw
16777216 /private/var/vm/sleepimage

Edit 2

Sparse Virtual Disk?

It has been suggested that the Parallel's virtual hard drive was sparse and was somehow not a real 30GB on the host's disk. It was a thin provisioned drive, but it was a real 30GBs of space. The drive was presented to Windows as an 70 GB drive, and after OS installation, application installation, and files it was 38GBs on the Mac's disk. In fact, I still have the file, just moved to my external hard drive, and can confirm that it is 38.61GB of actual storage on the host Mac, and inside of Windows it shows a roughly 70GB drive with a bit over 30GB's used.

Old Time Machine Backups

I was told that the file was still in /Volumes/MobileBackups as a local backup. I navigated to /Volumes/MobileBackups but the directory did not exist. No amount of sudoing and searching could find such a mount. This was done minutes after I first posted this question with no reboots or logouts in between.

Concerning Time Machine's preference on this Mac, I have an External USB drive that I use for Time Machine backups. I looked within Time Machine where the Parallels VM had been located on the internal SSD weeks ago. I did see the VM in the Time Machine history. I clicked on the old VM file and chose to delete all of the instances of that file from Time Machine. Oddly, I checked some other days and the file was still in that directory. I ended up having to manually seek through each day and remove that file. A grand total of seven instances of that file were removed from Time machine before no day had any record of it on the SSD. I rebooted and there was no reclamation of space.

Local Time Machine Storage

I then disabled local Time Machine storage with sudo tmutil disablelocal and rebooted. There was no reclamation of space.

So I'm still at square one. Somehow I managed to have 10 GBs of free space, delete a ~38GB file, and only have 11GB of free space afterward. I guess I'm special? =)

EDIT 3

I booted into recovery mode (Reboot and hold command + r), then entered disk utility. I checked the volume that was in my Mac and it reported some errors. I chose to "Repair Disk" and immediately after the repair, within Disk Utility, I saw that I had gained 36GBs of space! I rebooted into my system volume and the space remained reclaimed. Yay!

Solution 1:

It's likely in /Volumes/MobileBackups and you can easily delete it by entering Time Machine and navigating to the folder where the file existed. Select the file then command-click (right-click) and delete all backups of that file.

Normally, the system information window shows the backup space, but I have seen this window get hung up and not properly report storage space when Spotlight and/or the disk catalog are wonky.

You can also wipe all local backups by disabling the local store:

 sudo tmutil disablelocal

If the above steps doesn't work, you'll want to boot into recovery mode and run Disk Utility to check that the directory structure and file system catalog are correct. A fsck -fy / in single user mode is also equivalent if you are so inclined to fix things from terminal or want to perform a safe boot and have the system clean things up systematically.

Solution 2:

On a MacBook, Time Machine actually takes 2 snapshots each hour. The first one is stored locally, the second is what gets stored on your TM backup drive. TM is designed to be independent of the Finder, and TM "files" are not at all Finder-friendly; between that and the peculiarities of flash drives (newly freed space is not immediately made available), it's not surprising that the Finder loses track of what TM has been up to. My guess is that you deleted the virtual machine file between the two snapshots, or perhaps while a snapshot was in progress. The temporary snapshot of your VM is going to be huge, because even the slightest change results in a "new" 30+ GB file. (This is why you have to exclude VMs from Time Machine backups.)

Doing a Disk Utility repair every month month or two is good housekeeping - especially with a flash drive. You can catch and repair minor glitches before they have a chance to compound themselves into major problems.