[zarzavat]

The trick is to reboot into recovery partition, disable SIP, then run OmniDiskSweeper as root (as in `sudo /Applications/OmniDiskSweeper.app/Contents/MacOS/OmniDiskSweeper`). Then you can find all kinds of caches that are otherwise hidden by SIP.

[prmph]

It shouldn't be this hard to clear unwanted data from my own computer

[jasomill]

My immediate reaction to this is that the OS has a hard time establishing intent, and in some cases it probably should be this hard to delete data that's required for the system to boot on the grounds that you'd probably want it if you understood what it was, and ideally also hard for malware to delete data it doesn't want on your computer (forensically useful logs, backup copies of files encrypted by ransomware, etc.).

But none of this applies to caches and temporary files, which could be reasonably managed for 99% of users by adding a "clear all caches" checkbox in the reboot dialog with a warning that doing this is likely to slow down the system and increase battery usage for the next few hours, or to system-managed snapshots that mostly just need better UI and documentation.

UI transparency is my only real complaint. A reasonable amount of data the system wants to make difficult to delete is fine, so long as it clearly explains what it is and why. "System Data" is only acceptable as a description for the root of what should be a well-documented hierarchy.

[nuker]

Hmm, Full Disk Access perm is not enough?

[zarzavat]

Full Disk Access just gives an application the same filesystem powers that your user account has. For most users that means it has administrator level access, which is the 3rd highest tier.

There are two levels above an administrator-level account: 1) the root user can access files that an administrator can't (e.g. the files of other users and certain system configuration files), and 2) the kernel and system processes can access "system" files that even root cannot - this is enforced by SIP.

Apple is quite liberal in what they hide away with SIP. It's possible for disk space to leak whereby the OS has decided to store some file that it doesn't need and there is no way to even list such files without following the above instructions - the only indication will be a mysteriously large amount of space taken up by the system.

It goes without saying that if you're going to delete system files you should make sure you know what you're doing.