Sleepimage deletion in Mac
I am not able to delete the sleep image. It currently runs on macOS Catalina. As root, when I try to delete the sleep image I get the message "Operation not permitted".
Can someone help answer how do I delete the sleep image?
TL;DR Under macOS Catalina, to remove the sleepimage file using Terminal while booted normally to your Desktop, use the following command:
sudo pmset hibernatemode 0
Tested under a macOS Catalina (10.15.6) system, without FileVault, the following was all that was necessary to remove the sleepimage file, typically located at: /var/vm/sleepimage
Note that this was done in a normal mode boot and booting to macOS Recovery and disabling System Integrity Protection was not needed. Even if booted to macOS Recovery, one does not need to disable System Integrity Protection in order to delete the sleepimage file from there.
Booted to my normal Desktop, in Terminal I ran the following commands to show it can be done as advertised:
~ % pmset -g | grep 'hibernatefile\|hibernatemode'
hibernatemode 3
hibernatefile /var/vm/sleepimage
~ % ls /var/vm/
kernelcore sleepimage
~ % sudo pmset hibernatemode 0
Password:
~ % ls /var/vm/
kernelcore
~ %
- Setting hibernatemode to 0 automatically removed the sleepimage file.
- Setting hibernatemode back to 3 recreated the sleepimage file.
Notes:
- The system I used did not have FileVault enabled, however, I doubt it would make any difference if it did.
- Tested under normal mode boot in macOS High Sierra after using
sudo pmset hibernatemode 0
, I had to manually delete thesleepimage
file using:sudo rm /var/vm/sleepimage
- Did not test under macOS Mojave, however, one of the methods used under macOS High Sierra or macOS Catalina should work.
To remove the sleepimage file from macOS Recovery in macOS Catalina 10.15.6, without FileVault, I tested the following without disabling System Integrity Protection.
- Booted to macOS Recovery
- Opened Terminal from the Utilities menu.
- Ran
diskutil list
to ascertain which disk was APFS Volume VM. It was:disk1s4
mkdir /Volumes/VM
diskutil mount -mountPoint '/Volumes/VM' disk1s4
rm /Volumes/VM/sleepimage
diskutil unmount '/Volumes/VM'
reboot
Note: This was included just to show doing the SIP Dance is not necessary under macOS Catalina, just remove it from a normal mode boot.