A few days ago my Mac Mail.app hiccuped and all my custom mailboxes disappeared. (They were alive and well in my web-based Gmail.) A Google search suggested trashing /Library/Containers/com.apple.mail. I did that, then started mail, which created a new com.apple.mail folder. After a while, Mail started re-downloading and all the mailboxes reappeared.
Today I emptied the trash and got the message that com.apple.mail (the one I trashed a few days ago) was “in use” and couldn’t be deleted. Get Info showed that the folder and the Data folder within, and the DataVaults file within, are not locked and my user has read/write access.
I restarted in Safe Mode and it still wouldn’t delete the items. What should I try next?
cd ~/.Trash means “change directory” into the ~/.Trash/ folder
mv -vf * /tmp/ means “move” all (*) files to the /tmp/ folder
-v means “be verbose” aka “show me what files you move”
-f means "force the files to move, overwriting any files in /tmp/ that have the same name.
“Why do I have to reboot?”
The /tmp folder is a temporary folder (hence the name tmp) and its contents are deleted when you reboot.
Since the Mail.app won’t be running when you reboot, macOS will be able to delete the files in /tmp/ even if you could not.
“Why not use rm -rfv * instead of mv -vf * ?”
Because if you make a mistake with rm -rfv you can find yourself deleting all of your files.
Using mv to move the files to the /tmp/ folder is safer because the -v flag means that it will show you the files it is moving from the trash to the /tmp/ folder. If you don’t want to delete them (why were they in the trash?), all you have to do is mv them back again before you reboot.
Moving files from one folder to another (because mv did something undesirable) is much easier than restoring from backups (because rm did something undesirable).
In years past I have occasionally deleted the entire .Trash folder when faced with undeletable files (rm -rf). That’s no longer possible. If fact, I can’t even see files in .Trash now (ls -al).
You can just type lsof | grep, space afterwards, and drag the file from Trash into the Terminal.
That should tell you which process is using the file, if it is indeed in use. Then you can quit or force quit the process from Activity Monitor before you clear the Trash.
Does that mean nothing’s actually using the file (or folder)?
Here’s what it looks like in the Finder:
Although DataVaults has a disclosure triangle, the triangle reveals nothing inside.
I moved it all out of the Trash and tried to move move DataVaults out of the folders, and Finder said I “don’t have permission to access some of the items.” Get Info for DataVaults says “You have unknown access.” I tried to open it in BatChmod and got the message, “That file or folder does not seem to exist.”
Problem solved! I found this MacRumors post that said DataVaults are impossible to delete without temporarily disabling System Integrity Protection. So I rebooted to recovery mode, ran “csrutil disable” in the Terminal, rebooted to normal mode, emptied the trash with success, then went back to recovery and ran “csrutil enable.”
