How to delete sleepimage on macOS High Sierra

If you’ve tried to delete the sleepimage on High Sierra, you’ve probably come across this message: rm: /private/var/vm/sleepimage: Operation not permitted.

This file is now covered under SIP (System Integrity Protection), so it’s not as easy to delete as in previous versions of MacOS. You’ll now need to disable SIP, delete the file, re-enable SIP again.

Before we get started, let’s just cover the basics – the only reason you’d want to delete the sleepimage is if you’ve set the hibernatemode to 0 (hibernation disabled). If this doesn’t make sense to you, stop now and read up about hibernation modes. By default, hibernation is enabled on all portables and it’s probably best to keep it that way unless you know what you’re doing. Deleting the sleepfile will have little effect if hibernation is enabled; the file will come back straight away.

Assuming you want to completely disable hibernation, the first step will be to confirm that the hibernatemode is set correctly. Sometimes this setting can reset back to default, for example during an OS update, or when you change the energy saver prefs. So, open up terminal, and paste this:

sudo pmset -a hibernatemode 0

Restart your machine and hold down CMD + R to boot into recovery mode. When that loads, go to Utilities > Terminal, and enter the following to disable SIP:

csrutil disable
reboot

When your machine starts back up, go into terminal and remove the sleepimage. This time, it’ll work. You’ll also need to create a blank sleepimage file and make it unwritable, otherwise the full file will come back fairly quickly.

sudo rm -f /private/var/vm/sleepimage
sudo touch /private/var/vm/sleepimage
sudo chflags uchg /private/var/vm/sleepimage

Now boot back into recovery mode and re-enable SIP:

csrutil enable
reboot

When you’re back into MacOS, go into terminal one final time, and verify that SIP is enabled and the sleepimage has a size of 0 bytes:

csrutil status
ls -la /private/var/vm

You’ll need to check the sleepimage file every now and then. As above, there are various triggers that can cause the OS to re-create the full file. If it comes back, just perform the steps above to get rid of it again.