Undeletable file

Greetings,

I'm trying to delete a file with a weird name from within Terminal on a Mac.
It's a very old file (1992) with null characters in the name: ���Word Finder® Plus™�.

Here are some examples of what I've tried:

12FX009:5 dpontius$ ls
��Word Finder® Plus™
12FX009:5 dpontius$ rm "��Word Finder® Plus™"
rm: ��Word Finder® Plus™: Invalid argument

12FX009:5 dpontius$ rm -r
usage: rm [-f | -i] [-dPRrvW] file ...
       unlink file
12FX009:5 dpontius$ ls
��Word Finder® Plus™

12FX009:4 dpontius$ rm -r 5
rm: 5/��Word Finder® Plus™: Invalid argument
rm: 5: Directory not empty

12FX009:5 dpontius$ mv ��Word Finder® Plus testName
usage: mv [-f | -i | -n] [-v] source target
       mv [-f | -i | -n] [-v] source ... directory

12FX009:5 dpontius$ mv "��Word Finder® Plus™" testName
mv: rename ��Word Finder® Plus™ to testName: Invalid argument

Help appreciated greatly!

cheers,
dp

Hi...

On inspection the two NULL characters that you have shown us are unicode when hexdumped:

Last login: Thu Jul 18 16:34:33 on console
AMIGA:amiga~> hexdump -C <<< "��Word Finder® Plus™"
00000000  e2 90 80 e2 90 80 57 6f  72 64 20 46 69 6e 64 65  |......Word Finde|
00000010  72 c2 ae 20 50 6c 75 73  e2 84 a2 0a              |r.. Plus....|
0000001c
AMIGA:amiga~> _

Have you tried the GUI dragging the file to the 'Trash' from within Finder, then clearing the Trash?
How about using single quotes instead of double?
How about mv '��Word Finder® Plus™' /tmp/testname in single quotes and let the system remove it during reboot.
Are all the relevant permissions set for YOU to read and write from and to the file?
Remember any of these could cause problems so be very aware.
And finally are you absolutely sure you have the FULL filename and not missing, say, trailing spaces(s)?
That is all I can think of so far...

Try with wildcards, -i prompts for each match, so you can say yes only to the desired match:

rm -i ./*Word*

FWIW, I would solve this by doing exactly what MadeInGermany suggests in post#3 (unless there are so many files in the directory that you would be there all day to do it).

Thanks so much for the prompt ideas. Unfortunately, none have succeeded. I've repeated tried to delete by dragging and always get "The operation can't be completed because an unexpected error occurred (error code -50)." The file is in a folder by itself that I've tried to delete the entire folder, but that won't work either.

Latest attempts:

Single quotes

12FX009:5 dpontius$ rm '��Word Finder® Plus™'
rm: ��Word Finder® Plus™: Invalid argument

rename with testname in tmp folder:
12FX009:5 dpontius$ mv '��Word Finder® Plus™' /tmp/testname 
mv: rename ��Word Finder® Plus™ to /tmp/testname: Invalid argument

Permissions look fine:
12FX009:5 dpontius$ ls -l
total 48
-rwxr-xr-x@ 1 dpontius  staff  0 Feb 27  1992 ��Word Finder® Plus™

Delete with wildcards:
12FX009:5 dpontius$ rm -i ./*Word*
remove ./��Word Finder® Plus™? y
rm: ./��Word Finder® Plus™: Invalid argument

Throughout, the little bugger is still there. No trailing spaces present. I find it interesting to see the unicode characters wisecracker revealed. Does anyone know how to use that information to identify a file to delete?

Much obliged.

cheers,
dp

Oh, it's in a folder by itself. Okay then, how about (from the directory above):

# rm -rf <directory name>

That is use -r (for recursive) and -f (for force)

What does that do using the nuclear options?

Thanks, but the zombie remains:

12FX009:4 dpontius$ ls
5
12FX009:4 dpontius$ # rm -rf 5
12FX009:4 dpontius$ ls 5
��Word Finder® Plus™

Ah, no. When I said:

# rm -rf <directory name>

the # was meant to be the root prompt as I was assuming you would login as root.

Do NOT type the '#' :

rm -rf <directory name>

Thanks, I didn't catch that, but it's still giving me trouble.

sh-3.2# rm -rf 5
rm: 5/��Word Finder® Plus™: Invalid argument
rm: 5: Directory not empty
sh-3.2#

sigh. I used the "sudo su" method rather than enabling root from the preferences. Should I try that?

cheers,
dp

This is proving difficult.

Can you please post:

1. The output of ls -li on the zombie so we can see the file size, access rights and inode number.
2. What operating system is this?
3. What type of filesystem is this? eg, ZFS, UFS or what?

There are other nuclear options but you would need to do a full filesystem backup first, then keep users off until the job is done.
We are talking filesystem internals now.

Does your find command offer the -delete action?

find . -delete

Hmm, looking at the hexdump reminded me of something that happened in my AMIGA heydays...
Because you quoted that file dates back to 1992 maybe instead of each 'NUL' character being decoded as a UNICODE, they are a single byte ONLY.

I suspect that each 'NUL' is not 0xE2 0x90 0x80 but is in fact ONLY 0x00 with the top bit set giving 0x80 and they are being interpreted as UNICODE characters.
I have no idea if this would work but this might work in bash:

namestart=$'\x80\x80'
rm -rf "${namestart}"*
 

This could even apply to the (R) and TM characters as well.
Just a lateral thought.

Hello dpontius,

Can you get the output from ls -li in the directory? That should list the inode number in the first column. You could then use find like this:-

/tmp/tmp.jwq73hdq # ls -li
total 0
2360780 -rw-rw-r-- 1 rbatte1 rbatte1 0 Jul 19 08:54 ��Word Finder® Plus™
/tmp/tmp.jwq73hdq # find . -inum 2360780 -exec rm {} \;
/tmp/tmp.jwq73hdq # ls -li
total 0
/tmp/tmp.jwq73hdq #

Does that help? If not, what does the output of lsattr give you?

/tmp/tmp.jwq73hdq # rm *
rm: remove write-protected regular empty file `��Word Finder® Plus™'? y
rm: cannot remove `��Word Finder® Plus™': Operation not permitted
/tmp/tmp.jwq73hdq # lsattr
----i--------e- ./��Word Finder® Plus™
/tmp/tmp.jwq73hdq # chattr -i *
/tmp/tmp.jwq73hdq # rm *
/tmp/tmp.jwq73hdq #

...... maybe even a combination of this then the find might be needed.

I hope that this helps,
Robin

I know that you say that you want to delete this "zombie" file but do you know how it got there? With a name like that including unprintable characters and possibly a set inode number I have a thought that it could be part of a license key for an age-old application. If you are still using that application you could find that it stops dead as soon as you succeed in deleting this file.

The filename seems to be illegal, not accepted by the MacOS kernel.
And seems to be impossible to delete.
Even in C it is

int unlink(const char *pathname);

so the illegal file name comes into effect.

What kind of file system is it?

df -k .

tells the device path of the current folder.
Is it an external drive?
Was the file created by another computer, with a different OS?

I'm back. Thanks for your patience, I hope you all haven't lost interest.

Responses to suggestions and requests:

12FX009:5 dpontius$ ls -li
total 48
963069 -rwxr-xr-x@ 1 dpontius  staff  0 Feb 27  1992 ��Word Finder® Plus™

This is a 2013 MacPro running OSX 10.11.6 with Journaled HFS Plus

12FX009:5 dpontius$ find . -delete
find: -delete: unlink(./��Word Finder® Plus™): Invalid argument

12FX009:5 dpontius$ namestart=$'\x80\x80'
12FX009:5 dpontius$ rm -rf "${namestart}"*
12FX009:5 dpontius$ ls
��Word Finder® Plus™

This file was on ancient backups that I copied years ago onto my now-spacious hard drive. I suspect that it (and a second file from 1998 I haven't mentioned yet called �SurfSim 1.0.0� Prefs�) were part of some copy protection scheme. I've used neither program for decades. So yes, the file was created on a very different operating system, whatever the Macintosh was running two decades ago.

cheers,
dp

I think you need a "disk editor" tool that allows to edit the directory entries.
Cannot recommend any - I am not a Mac user.

debugfs with its unlink and rm commands comes to mind, but it might suffer from the same problems as the other tools. When using it, be very careful and know exactly what you are doing!

Have you tried:

find <parent-directory> -delete

Tried the last suggestion by hicksd8, find and delete, no luck.

Also, I moved the thread to the OS-X forum as that seems more appropriate. I'd intended it to be there from the start.

cheers,
dp