How to get rid of default Mac OS apps like GarageBand

9 minute read Published:

GarageBand from Apple is probably an amazing program for people who love to listen to and create music. I don't, so I lately decided to get rid of these unused 1s and 0s on my disk. Turns out it is not as easy as it sounds since Apple does not like it if you tamper with the Mac OS experience they have in mind for you. Consequently, there is no official uninstaller. It is not too hard though to discover the files yourself and just delete them. Using GarageBand as the example, this post is about how to navigate the Mac OS file system and purge all traces of the Mac OS standard applications that nobody ever asked for.
Table of Contents

tl;dr

This post is about how to discover files on Mac OS for those apps Apple forgot to put an uninstaller onto the system. If you don’t care and just want to delete GarageBand right now, the short version is this: sudo rm -rf on the following list of directories should be all you need

  • /Applications/GarageBand.app
  • /Library/Audio/Apple Loops/Apple/
  • /Library/Application Support/GarageBand
  • /Library/Application Support/iLifeMediaBrowser/Plug-Ins/iLMBGarageBandPlugin.ilmbplugin
  • ~/Library/Containers/com.apple.STMExtension.GarageBand
  • ~/Library/Containers/com.apple.garageband10
  • ~/Library/Application Scripts/com.apple.garageband10
  • ~/Library/Application Scripts/com.apple.STMExtension.GarageBand
  • ~/Library/Caches/com.apple.helpd/Generated/com.apple.garageband10.help*10.2.0
  • ~/Library/Caches/com.apple.helpd/SDMHelpData/Other/English/HelpSDMIndexFile/com.apple.garageband10.help*10.2.0

Now run something like sudo updatedb && locate garage and you should not get too many results back. Note: in my case, the cache folder is somehow recreated after a reboot. So far, I have not figured out how to stop Mac OS from doing this. There will also be some BOM files, which I decided to keep just in case. More about them below.

How to find all the files

Many sites on the internet tell you what to delete to remove a specific program like GarageBand but few tell you how to find these files yourself. As I believe it is better to understand what you do before you just combine sudo rm -rf with strings copied from stack overflow, I rather search for myself. Good readings for the necessary background knowledge include the Apple docs and this nice but slightly outdated personal homepage.

In Mac OS, the applications you install look very self-contained at first. You drag a single file into the “Applications” folder and that is it. To remove an app though, you may have to take more steps since apps tend to silently pollute your system by putting additional files all over the place.

The first place to start is by looking at pkgutil, as explained for instance in this post. You can use it like so to list all the packages:

 ~ $ pkgutil -v --pkgs
Active packages on '/':
        com.apple.pkg.DevSDK_macOS1013_Public
        com.apple.pkg.macOSBrain
        com.apple.pkg.MAContent10_AssetPack_0637_AppleLoopsDrummerKyle
        com.apple.pkg.MAContent10_AssetPack_0593_DrummerSoCalGBLogic
...

For me, it lists a whole lot of apple packages followed by those that I actually installed myself. The way it works is that it looks for so-called “receipts” on the system, which are lists of files that an application consists of. Sounds easy, but as you will soon see, they alone are not sufficient. I will first go into details of BOM files and then into how to search the system in general.

BOM files

Mac OS installers use BOM files to determine the list of all files that they will install for a particular application, what their permissions should be, etc. They remain on the system and are a good starting point when looking for files to delete. Read more on BOM files in the man pages: man bom. Unlike written in the man page, BOM files can be found in several directories:

  • /Library/Receipts/
  • /System/Library/Receipts/
  • /var/db/receips (actually /var is a symlink to /private/var and interestingly, the Apple documentation does not even mention this fact)

In our case, we look for all BOM files related to GarageBand. A simple find should do the trick:

 ~ $ find {/Library/Receipts/,/System/Library/Receipts/,/var/db/receips}  -name '*.bom' -print | grep -i garage
/Library/Receipts/com.apple.pkg.GarageBand_AppStore.bom
/System/Library/Receipts/com.apple.pkg.MAContent10_AssetPack_0324_AppleLoopsBluesGarage.bom
/System/Library/Receipts/com.apple.pkg.MAContent10_AssetPack_0325_AppleLoopsGarageBand1.bom

This returns three files that seem to be related to GarageBand. The man pages suggest lsbom to check the contents of a BOM file. For instance, this is how to list all entries of a BOM file:

 ~ $ lsbom -f /Library/Receipts/com.apple.pkg.GarageBand_AppStore.bom
./Applications/GarageBand.app/Contents/Frameworks/Animal.framework/Versions/A/Animal    100775  0/80    7943184 244980342
./Applications/GarageBand.app/Contents/Frameworks/Animal.framework/Versions/A/Resources/Info.plist      100664  0/80    1362    3999848628
./Applications/GarageBand.app/Contents/Frameworks/Animal.framework/Versions/A/Resources/version.plist   100664  0/80    569     404859251
...

To quickly check where all the files are, just grep away folders until nothing is left:

 ~ $ lsbom -f /Library/Receipts/com.apple.pkg.GarageBand_AppStore.bom | grep -v './Applications/GarageBand.app'
 ~ $ lsbom -f /System/Library/Receipts/com.apple.pkg.MAContent10_AssetPack_0324_AppleLoopsBluesGarage.bom | grep -v './Library/Audio/Apple Loops/Apple/11 Blues Garage'
 ~ $ lsbom -f /System/Library/Receipts/com.apple.pkg.MAContent10_AssetPack_0325_AppleLoopsGarageBand1.bom | grep -v './Library/Audio/Apple Loops/Apple/Apple Loops for GarageBand'

This suggests to delete at least the following folders to get rid of GarageBand:

  • /Applications/GarageBand.app, the app itself
  • /Library/Audio/Apple Loops/Apple/11 Blues Garage, some “.caf” files presumably containing Audio to be used in GarageBand projects.
  • /Library/Audio/Apple Loops/Apple/Apple Loops for GarageBand, more “.caf” files.

In fact, the entire Apple loops folder looks like we can delete it as it seems to just contain many audio files, not all named after GarageBand:

 ~ $ ls -la /Library/Audio/Apple\ Loops/Apple/
total 0
drwxrwxr-x  13 root  416 Jun  8  2017  ./
drwxrwxr-x   3 root   96 Oct 26 11:13  ../
drwxrwxr-x 307 root 9824 Jun  3  2015 '01 Hip Hop'/
drwxrwxr-x 210 root 6720 Jun  3  2015 '02 Electro House'/
drwxrwxr-x  52 root 1664 May 16  2017 '03 Dubstep'/
drwxrwxr-x  59 root 1888 May 16  2017 '04 Modern RnB'/
drwxrwxr-x 198 root 6336 Jun  3  2015 '07 Chillwave'/
drwxrwxr-x 126 root 4032 Jun  3  2015 '08 Indie Disco'/
drwxrwxr-x 300 root 9600 Jun  8  2017 '09 Disco Funk'/
drwxrwxr-x 102 root 3264 Jun  3  2015 '10 Vintage Breaks'/
drwxrwxr-x 134 root 4288 Jun  3  2015 '11 Blues Garage'/
drwxrwxr-x 146 root 4672 Jun  8  2017 '13 Drummer'/
drwxrwxr-x 133 root 4256 May 16  2017 'Apple Loops for GarageBand'/
 ~ $ du -h -d 0 /Library/Audio/Apple\ Loops/Apple/
472M    /Library/Audio/Apple Loops/Apple/
 ~ $ file /Library/Audio/Apple\ Loops/Apple/11\ Blues\ Garage/Texas\ Roadhouse\ Slide\ Guitar.caf
/Library/Audio/Apple Loops/Apple/11 Blues Garage/Texas Roadhouse Slide Guitar.caf: CoreAudio Format audio file version 1

In total the folder is around 500 MB in size and full of these CoreAudio audio files. A bit of DuckDuckGoing suggests these are actually some sort of “riffs” for GarageBand and other Audio editing files. Clearly they must go away.

BOM files are nice but insufficient because they only contain the files that are installed by a package, not those that are, e.g., created or downloaded after installation. As far as I can tell, you will not get around a real inspection of the entire file system if you want to really delete it all.

Apple file system structure

Apple has a standard file system structure. It is somewhat similar to Linux but there are several additional directories. Overall, the file system is structured into (at least) four different domains:

  • System domain: files needed to run the OS. You find them in /System. Better don’t touch these files unless you really want to free some space.
  • Network domain: files shared on your local area network. You find them in /Network. This seems to be for files shared on the network. Not your system, so no need to look for anything in there.
  • Local domain: files specific to the computer and shared among all users on the computer. You find them in /Applications and /Library.
  • User domain: files specific to users on your computer. You find them in the /Users folder, which contains subfolders for each user on your system. Users' subfolders each contain multiple folders, among them Applications and Library folders similar to the local domain. These two folders may contain data created by installed applications.

Searching for additional files

Looking into the /Library folder, we can search for anything with “garage” in the name and iteratively grep out folders until the output is readable. For me, this is what it comes down to:

 ~ $ find /Library -print 2>/dev/null | grep -i garage \
                                      | grep -v '/Library/Application Support/GarageBand' \
                                      | grep -v '/Library/Audio/Apple Loops/Apple/Apple Loops for GarageBand' \
                                      | grep -v '/Library/Audio/Apple Loops/Apple/11 Blues Garage' \
                                      | grep -v '/Library/Application Support/iLifeMediaBrowser/Plug-Ins/iLMBGarageBandPlugin.ilmbplugin'
/Library/Receipts/com.apple.pkg.GarageBand_AppStore.bom
/Library/Receipts/com.apple.pkg.GarageBand_AppStore.plist

We found the two Apple loops folders listed in the BOM files, some sort of plugin and some stuff in /Library/Application Support. The application support folder is used by applications to store additional data, e.g., if an app modified files bundled with it or downloads additional files after installation. GarageBand seems to store a lot of audio files in it.

The plugin in the list of files up there is for something called the “iLifeMediaBrowser”, which appears to be part of the iLife product, which in turn appears to consist if GarageBand and iMovie (Wikipedia). You probably don’t want this program either, but that is for another day.

Even though GarageBand is installed system-wide, there could be some files in user-specific directories. For instance, I found this when looking for the string “garage”:

 ~ $ find /Users/dominic/Library/ -print | grep -i garage \
                                         | grep -v '/Users/dominic/Library/Containers/com.apple.STMExtension.GarageBand' \
                                         | grep -v '/Users/dominic/Library/Containers/com.apple.garageband10'
/Users/dominic/Library/Application Scripts/com.apple.garageband10
/Users/dominic/Library/Application Scripts/com.apple.STMExtension.GarageBand
/Users/dominic/Library/Caches/com.apple.helpd/Generated/com.apple.garageband10.help*10.2.0
/Users/dominic/Library/Caches/com.apple.helpd/Generated/com.apple.garageband10.help*10.2.0/en.cshelpindex
/Users/dominic/Library/Caches/com.apple.helpd/SDMHelpData/Other/English/HelpSDMIndexFile/com.apple.garageband10.help*10.2.0

Files in /Users/dominic/Library/Containers/ are application data created from apps running in an Apple sandbox. A sandboxed app will only be able to access files in it’s container folder, limiting the blast radius of vulnerabilities in them. More about sandboxing in Mac OS is found here.

All files in /Users/dominic/Library/Caches should be just cache data and can be deleted at any time without much danger. What is left is the stuff in /Users/dominic/Library/Application Scripts, which are empty folders that could contain AppleScripts, an Apple-specific scripting language for task automation.

This should be pretty much it. Of course the search we did depends on properly named files and folders. We only found things that have “garage” in their name plus some related files like these Apple Loops. Thus, a final step is searching the internet for the myriads of other websites about this topic and see if they recommend any other locations. I did not find anything, so I consider GarageBand deleted now.

Bonus: File types in BOM files

If you looked at the output of the lsbom command closely, you might have seen the strange numbers listed for all the files. These are actually the full file type and permission information for the files to be installed on the system. Out of interest, I quickly checked what these file types can be.

The last 4 digits are the standard file system permissions you edit with chmod. What may be less well known are the one to two digits before that. They actually specify the type of the file. It is encoded as a double-digit numerical value but preceding zeros are omitted from the output. For existing files, you can check see these numbers by running stat -f "%p" TheFile.

This is how to create a few different files to see what their first two digits are:

 /tmp $ echo "Hello" > RegularFile.txt
 /tmp $ stat -f "%p" RegularFile.txt
100644
 /tmp $
 /tmp $ mkdir Directory
 /tmp $ /usr/bin/stat -f "%p" Directory/
40755
 /tmp $
 /tmp $ ln -s RegularFile.txt Symlink.txt
 /tmp $ /usr/bin/stat -f "%p" Symlink.txt
120755
 /tmp $
 /tmp $ mknod Pipe p
 /tmp $ stat -f "%p" Pipe
10644
 /tmp $
 /tmp $ /usr/bin/stat -f "%p" /dev/disk0
60640
 /tmp $
 /tmp $ /usr/bin/stat -f "%p" /dev/tty
20666
 /tmp $
 /tmp $ python -c "import socket as s; sock = s.socket(s.AF_UNIX); sock.bind('/tmp/Socket')"
 /tmp $ stat -f "%p" Socket
140755

You can now use lsbom to check what kind of files are installed. For instance, this command lists you all file modes that are not regular files, directories or symlinks: lsbom -p m com.apple.pkg.GarageBand_AppStore.bom | uniq | grep -v "^10" | grep -v "^4" | grep -v "^12". In this case, there are none.