A few weeks ago a customer checked in an iMac with symptoms of increasingly slow response and occasional kernel panics. The initial evaluation turned up the probable cause pretty quickly—the hard drive was completely full. This can affect performance in a couple of significant ways. First off, computers use free hard drive space for what is called virtual memory—essentially using the drive as extra RAM, and lots of it. When your drive gets full or close to it, that drive space cannot be used for virtual memory anymore and performance suffers significantly. Another effect of a full drive can be software and directory corruption due to the machine not being able to write changes to disk when the machine is shut down. These errors accumulate and can lead to apps not opening, lost preferences and a host of other issues including kernel panics, which this machine was experiencing.
Anyway, back to the story at hand: The usual suspects when the drive is full are pictures, music and movies. Those are the things everyone has the most of, and they take up lots of space. This customer had almost nothing on the machine, however. I changed the Finder view options to “calculate all sizes” and took a quick trip through the hard drive. With this option selected and using List view, you can find big folders pretty quickly. I saw that that his mail folder was 475GB, which was obviously why his drive was full. There was a folder inside his Mailboxes folder called Recovered Messages that had hundreds of copies of the same few messages. I tried to open one, but they were all corrupted. I deleted the messages, which freed up his drive, reinstalled his OS to clear any OS-related directory issues and observed for 24 hours to see if the problem recurred. It did not, so I figured it had to do with the message being corrupted and simply deleting and reinstalling had resolved the issue. Home went that machine, and on I went to the next repair.
A week later another machine came in with the same issue and had the same symptom of a large Recovered Messages folder filling up the drive. One machine I would consider a fluke but two raises suspicions, so I started doing some research and eventually found not only other people with the problem but fortunately a resolution as well. It turns out there is a bug in Mail somewhere that very occasionally causes Mail to keep recovering a specific message over and over until the drive is full. It seems to be only related to IMAP servers and triggered by large messages. The definition of “large” appears to mean “big enough to exceed your mail server’s message size limit,” whatever that may be. The message gets bounced back and the error causes it to be replicated over and over into the Recovered Messages folder.
The fix turns out to be very simple but involves a little command-line work in Terminal. First though, turn off your AirPort or unplug the ethernet cable—the machine must be offline while you do this or the problem will come right back. The offending message actually lives in an invisible folder and deleting it is the key to resolving this issue. So the next thing to do is to get your Mac to show you all the normally hidden files and folders.
In terminal type:
defaults write com.apple.finder AppleShowAllFiles TRUE
and hit enter.
Then type:
killall Finder
and hit enter. Now all the folders normally hidden will show up.
The next step is to navigate to:
~/Library/Mail/IMAP-username@yourmail.tld@imap.whatever.tld/.Offlinecache
Inside the offline cache folder you will find the offending message. Delete it and any other messages in there.
Hide all your hidden files again:
defaults write com.apple.finder AppleShowAllFiles FALSE
Hit enter, type:
killall Finder
and hit enter again. Now everything is back to normal. Delete ~/Library/Mail/Mailboxes/Recovered Messages and take your machine back online. All should be well.
After resolving this for the second customer, I contacted the first customer who had been slowly losing space again and got him up and running in just a few minutes.