Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Originally posted Nov 10, 2019

FINAL UPDATE: Issue located and eliminated!

I've used Disk Drill¹︎ by CleverFiles since accidentally re-formatting an important hard drive earlier this year. It recovered my files splendidly. Afterwards, I allowed it to run S.M.A.R.T. monitoring in the background and (apparently) it was also running some data protection processes.

The Issue
Disk Drill data protection includes creating hidden archives of deleted files—in case they need to be restored. When this is working properly, archives are limited to a percentage of free disk space. In my case, something went wrong with management of the archive; it was allowed to swell until it completely filled available space on my SSD. When I would delete a file, Disk Drill would then begin reclaiming it to store as an archive.

Research
Even with the highest level of administrator and disk access, DaisyDisk was only able to label the archives as "Hidden Space". It could not tell me where the space was in my file system, what it was, or what created it. So I started my MacBook Pro from an external hard drive containing a bootable copy of Mojave. I then ran DaisyDisk²︎ on the internal SSD of my MacBook Pro (the Mac HD - Data partition).

DaisyDisk found a hidden folder called .cleverfiles using over 230 GB in my SSD root directory. The Mojave Finder labeled the .cleverfiles folder size as 2.8 GB. Somehow .cleverfiles isn't listed at all when booted from my internal SSD (even with hidden files shown).

A web search for CleverFiles led me straight to Disk Drill. I also found many other forum posts with users who experienced the same issue spanning many years and multiple versions of macOS X. Most of the solutions involved deleting Disk Drill via the preferences window, as this should also delete the archives. That didn't work for me, neither did CleanMyMac.

Solution
My final solution was to again startup from my external Mojave drive and manually delete the .cleverfiles folder. While Finder still listed it as only 2.8 GB, the trash emptied for almost ten minutes and tens of thousands of files were deleted.

Conclusion
Not only did Disk Drill run amok with its archiving process, it stored the archives in a super-hidden folder that circumvents normal directory services. CleverFiles will be hearing from me very soon. In the meantime, I now have 240 GB of free space, which has remained for the past hour with no signs of dropping. So... back to work!

¹︎Downloaded via SetApp, a monthly app store service I highly recommend.

²︎DaisyDisk requires Full Disk Access via macOS Security preferences AND needs to 'Scan as Administrator'. The second part requires downloading the full version of DaisyDisk from their website, which is free to use if you purchased the Mac AppStore version.
 
Last edited:
  • Like
Reactions: theramajor
No matter the cause of disappearing space, I highly recommend analyzing your primary startup drive while booted from an external drive¹︎. With an external view of your hard drive and full permissions, finding the culprit should be simple. In my case, it allowed me to forgo a trip to the Genius Bar, avoid back and forth with app developers and fix the situation myself in one day.

Hopefully you already have a bootable backup of your startup drive. If not, it will require creating one via one of the following options²︎:
➊ Use Carbon Copy Cloner or Get Backup Pro³︎ to create a clone of your startup drive—an obvious challenge when your main boot disk is corrupt.
➋ Create an external bootable drive from a safe and working system. MacWorld provides instructions to do this for every major macOS release, including Big Sur.
➌ If you have another working Mac, you don't need a bootable drive. Instead, enable Target Disk Mode to mount the internal problem drive as a local volume on the other Mac. Apple provides instructions on this.

In any case, keep administrator account credentials handy for the problem Mac. Expect to download scanning software direct from developers, as MAS versions will be limited in scope⁴︎.


¹︎Depending on your security setup and version of Mac OS, this may require booting into system recovery to disable your firmware password and select a new startup drive.
²︎I highly recommend using an external SSD using at least a high-speed USB 3 connection. An external HDD will work, but the boot process is much slower.
³︎My choice, as it's available via SetApp.
⁴︎SetApp versions don't have theses limitation.
 
Is there a way to shut snapshots off?
I deleted and stopped using Daisy Disk. I believe that turning off S.M.A.R.T. monitoring would also fix the issue. However, I recommend completely deleting Daisy Disk, reinstalling, and not activating SMART in the first place.

It's disconcerting to think that—a year and new OS later—Daisy Disk is still causing the same issue.


I reported my entire experience to CleverFiles last year and did not mince words when explaining my dissatisfaction.
 
I have detected a lot of residual files in here /System/Volumes/Data/.cleverfiles/hlink.ref
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.