I am not able to delete the sleep image. It currently runs on macOS Catalina. As root, when I try to delete the sleep image I get the message "Operation not permitted".

Can someone help answer how do I delete the sleep image?


TL;DR    Under macOS Catalina, to remove the sleepimage file using Terminal while booted normally to your Desktop, use the following command:

sudo pmset hibernatemode 0


Tested under a macOS Catalina (10.15.6) system, without FileVault, the following was all that was necessary to remove the sleepimage file, typically located at: /var/vm/sleepimage

Note that this was done in a normal mode boot and booting to macOS Recovery and disabling System Integrity Protection was not needed. Even if booted to macOS Recovery, one does not need to disable System Integrity Protection in order to delete the sleepimage file from there.

Booted to my normal Desktop, in Terminal I ran the following commands to show it can be done as advertised:

~ % pmset -g | grep 'hibernatefile\|hibernatemode'
 hibernatemode        3
 hibernatefile        /var/vm/sleepimage
~ % ls /var/vm/
kernelcore  sleepimage
~ % sudo pmset hibernatemode 0
Password:
~ % ls /var/vm/               
kernelcore
~ % 
  • Setting hibernatemode to 0 automatically removed the sleepimage file.
  • Setting hibernatemode back to 3 recreated the sleepimage file.

Terminal


Notes:

  • The system I used did not have FileVault enabled, however, I doubt it would make any difference if it did.
  • Tested under normal mode boot in macOS High Sierra after using sudo pmset hibernatemode 0, I had to manually delete the sleepimage file using: sudo rm /var/vm/sleepimage
  • Did not test under macOS Mojave, however, one of the methods used under macOS High Sierra or macOS Catalina should work.

To remove the sleepimage file from macOS Recovery in macOS Catalina 10.15.6, without FileVault, I tested the following without disabling System Integrity Protection.

  1. Booted to macOS Recovery
  2. Opened Terminal from the Utilities menu.
  3. Ran diskutil list to ascertain which disk was APFS Volume VM. It was: disk1s4
  4. mkdir /Volumes/VM
  5. diskutil mount -mountPoint '/Volumes/VM' disk1s4
  6. rm /Volumes/VM/sleepimage
  7. diskutil unmount '/Volumes/VM'
  8. reboot

Note: This was included just to show doing the SIP Dance is not necessary under macOS Catalina, just remove it from a normal mode boot.