Noooo! Your trypical Macbook Pro crash story.

December 18, 2008 10:57 PM

OS X crisis.. Please help with a system that won't boot Mac gurus.

So I finally got around to installing the last security update to OS X 10.4.11 on my MBP (C2D) and after reboot my system hangs. It sits there on the grey apple screen and spinning thingy. The interweb reports that this is not uncommon so I followed the typical advice of loading Disk Utility off install DVD. Ran, found some glitches in the permissions and disk and repaired them successfully. It can see and mount the drive as well as report the free space and all that. Still a no go -- again hanging on the boot screen as my fan starts to whirl.

Considered Archive and Install but after selecting my hard drive volume and the Options button, it reports that it can't perform A&I and must erase the contents of the drive. GAH!

This sucker has some seriously important work that was recently completed on not yet backed up. Help me restore and I will be indebted to you forever.

posted by drpynchon to computers & internet (20 comments total)

This exact thing happened to me one year ago. I was told that upgrading Leopard can sometimes really screw up your computer (as opposed to a clean/fresh install of Leopard). I will spare you the unhappy ending.

Do you have a laptop that you can use to do a target/firewire boot, and get your important stuff onto that computer?
posted by iamkimiam at 11:15 PM on December 18, 2008

How do I do that? I'm using a PC now and also have access to an external (or will buy one) if necessary.
posted by drpynchon at 11:17 PM on December 18, 2008

external HD that is..
posted by drpynchon at 11:18 PM on December 18, 2008

How long are you leaving it on the grey spinning screen? Sometimes there's a filesystem check that takes a while (different from checking the permissions). Try booting in verbose mode (Cmd-V after booting) and see what the text boot screen tells you.
posted by holgate at 11:22 PM on December 18, 2008

Cmd-V yields:

hi mem tramps at 0xffe00000
PAE enabled
64 bit mode enabled
standard timeslicing quantum is 10000 us
vm_page_bootstrap: 513694 free pages
mig_table_max_displ = 71
Enabling XMM register save.restore and SSE/SSE2 opcodes
ACPI CA 20060421
AppleIntelCPUPowerManagement: ready
AppleACPICPU: ProcessorApicId=1 LocalApicId=0 Enabled
AppleACPICPU: ProcessorApicId=1 LocalApicId=0 Enabled

using 10485 buffer headers and 4096 cluster IO buffer headers
Enabling XMM register save/restore and SSE/SSE2 opcodes
Started CPU 01
IOAPIC: Version 0x20 Vectors 64:87
ACPI: System State [S0 S3 S4 S5] (S3)
Security auditing service present
BSM auditing present
disabled
rooting via boot-uuid from /chosen: 672545CA-...... (my omission)
Waiting on IOProviderClassIOResourcesIOResourceMatchboot-uuid-media
USB caused wake event (EHCI)
2.0.38 m0ead6f57 :2
2.0.38 m7b9b743c
2.0.38 Little Snitch: start
USB caused wake event (EHCI)
Got boot device = IOService/AppleACPIPlatformExpert/PCI0/AppleACPIPCI/SATA@1F,2/AppleAHCI/PRT0@0/AppleAHCIDiskDriver/IOAHCIBlockStorageDevice/IOBlockStorageDriver/FUJITSU MHW2120BH Media/IOGUIDPartitionScheme/Customer@2
FireWire (OHCI) TI ID 8025 built-in now active GUID 001b63fffe7e0230; max speed s800.
BSD root: disk0s2, major 14, minor 2
Extension "com.apple.driver.AppleUSBTCKeyboard" has no kernel dependency.
Extension "com.apple driver.AppleUSBTCKeyEventDriver" has no kernel dependency.
CSRHIDTransitionDriver::probe: -v
CSRHIDTransitionDriver::start before command
CSRHIDTransitionDriver::stop
IOBluetoothHCIController::start Idle Timer Stopped


And that's it... Let it go for many minutes at that line. Nothing connected to any USB ports.
posted by drpynchon at 11:40 PM on December 18, 2008

I think your best bet will be to startup your MBP in Target Disk mode; you do this by pressing T on startup. You will see a Firewire symbol on the screen, and your MBP now acts as an external harddrive that you can hook up to another Mac, through Firewire. Use this other Mac to retrieve all your important files.

Then, from this other Mac, I would run Diskwarrior and let it do its thing on your MBP (still attached in Target Disk mode). If this doesn't get the MBP going again, I would give up and start from scratch with an Erase & Install, then re-import your retrieved files once your fresh system is up & running.
posted by wildatheart at 12:09 AM on December 19, 2008

wildatheart: I am more than happy to do what you suggest (once I beg/borrow/steal another Mac) but am wondering if I will have issues with having permission to see user level files. Is there a way I will need to deal with this? The files are definitely there. My directory tree is visible and I can mount the drive. In fact, what I'm doing now is tediously copying files in the terminal to a FAT partitioned external USB drive also successfully mounted via the installation DVD. I'm not savvy with permissions but when I tried to mount my Mac HFS drive onto an Ubuntu partition I once kept (via refit) it gave me all kinda problems.
posted by drpynchon at 12:18 AM on December 19, 2008

In my experience, you will not have any problems seeing (and/or copying) files off the Target Disk Mode machine. To give yourself the Diskwarrior option, you will need to use another Mac for your rescue operation anyway, so personally I would make getting hold of another machine my priority.

I don't know if you are close to one (and you probably know this), but professional photography equipment hire places will often have MBP's available for daily hire.
posted by wildatheart at 12:36 AM on December 19, 2008

Thanks for your help guys. I'm going to give the Target Disk mode and Diskwarrior a shot but have two final questions before I try to get some sleep:

1) If it's true that you can easily access your data in this fashion, doesn't that make this a huge security gap? Why can't someone just bypass my login screen by loading in target disk mode and going to town?

2) If I want to backup my data, I'll obviously make backups of everything in the /User/xxx directory (where all my documents/photos/etc are) but are there any other key directories outside of /User that should be backed up like shared data or network settings?

Again, thanks a ton. I know this might end up being a royal pain but as long as my data is retrievable, I'm totally happy (and so far it looks like I'm accessing it without any grief).
posted by drpynchon at 12:57 AM on December 19, 2008

1) If it's true that you can easily access your data in this fashion, doesn't that make this a huge security gap?

No, because physical access to the machine defeats any security measure short of hard encryption. If I can boot your machine into Target Disk Mode without you noticing, I can pretty well open it up, take the hard drive out, walk away, and analyze it at my leisure. (Speaking of which, do you have FileVault turned on? Because if so, your process just got exponentially harder.)

Have you considered buying a Time Capsule? I'm pretty happy with mine, has gotten me out of a number of data-loss jams with no muss no fuss.
posted by ikkyu2 at 1:33 AM on December 19, 2008

ikkyu2: No I don't use FileVault and have considered Time Capsule but remain disappointed by its limitations vis-a-vis NAS drives which is what I use for selective, periodic backups of data. This is just very bad timing as the final composite data from several months of chart extraction on the way to a major publication were there and there alone just prior to this nonsense. I may reconsider and perhaps even do both with use of Time Capsule on a USB drive as I'm obviously learning now that it offers the major advantage of convenient restoration in addition to backup when things go awry.

I must say, this sort of thing seems a major dent in what I considered the stability of the Mac platform. If a simple security update causes this serious a calamity it doesn't speak well of things.

Also is there at least a BIOS level way to password protect access to target disk mode and other simple vulnerabilities like this? Physical access to computers at a workplace isn't as hard to come by as you are making it.
posted by drpynchon at 2:16 AM on December 19, 2008

Disabling target disk mode (among other things):

http://support.apple.com/kb/HT1352

Regarding your main issue, have you tried booting in safe mode?
posted by Your Time Machine Sucks at 3:37 AM on December 19, 2008

And when you sort all this out and can happily make back-ups, please do so to two separate locations. The last hard drive crash I experienced was during a back-up leaving me with a broken (irretrievable) hard drive and an incomplete copy.
posted by firstdrop at 4:33 AM on December 19, 2008

nthing the idea that you've got a corrupted hard disk directory, and that DiskWarrior will likely solve the problem with the disk enough that you can re-install your OS and move on. Of course, flattening the volume with Disk Utility will resolve the problem too, but then you lose your data.

Every volume in Mac OS X (so HFS, HFS+ Extended, Journaled) has a disk directory. A disk directory is like a very complex cross-referenced table of contents of what's stored on the disk. When the file system needs to know where something is at, it references the disk directory, and also for the I/O or read/write functions of the OS. It's a bit more complicated than that, but that's a layman's description that's good enough to understand why you'll need to repair (or replace) (or repair, then replace) your disk directory before you can move on. When a directory becomes damaged, often the OS can't read or write to the file system on the disk. This results in symptoms like a volume not mounting, or Disk Utility wanting to re-initialize the disk because it doesn't know what else to do with it (it thinks it's a un-initialized volume with no directory). You'll also see, sometimes, the volume mountable but the OS can't write to it, and so you won't be able to do things like install the OS. Mac OS X's installer has a safety-check in it that doesn't allow it to install on a volume with a directory it can't verify.

So this is where DiskWarrior can save you as it's saved my ass many hundreds of times. It's a bit expensive as far as utilities go, but worth every penny I've spent on my license. DiskWarrior specialized in rebuilding disk directories. It will scan your volume for errors and rebuild a new directory based on the contents on the volume, if possible. About 1 time out of 20, I'll run into a directory that's so damaged that it can't be rebuilt. In these cases, DiskWarrior will attempt to mount your volume as read-only so you can copy data off it to another place, after which you'd then use Disk Utility to re-initialize your volume (which, of course, lays down a fresh (empty) directory. If DiskWarrior is able to rebuild your directory, it'll show you a report for what's wrong and then give you the ability to replace your old directory with the newly rebuilt one.

My SOP for this is that I've built an external Firewire/USB HD with Mac OS X on it with DiskWarrior installed. I boot from the external "Tools Disk" and run DiskWarrior on the internal volume. The advantage to this is that I can keep the Tools Disk up-to-date and it's way faster than trying to boot from the DiskWarrior CD.
posted by mrbarrett.com at 6:28 AM on December 19, 2008

-Target disk mode for the Macbook pro, plug it in via firewire into another Mac, and it will show up as an external hard drive.

-From the parent Mac, download that last update (Intel or PowerPC)

-Run the update installer, and choose the external drive (your macbook pro) as the target.

-Eject the external drive, remove the firewire and reboot your machine.

-If this fails, boot the machine in target mode again, and use Tech Tool or Disk Warrior to do a full scan on your drive and repair everything.

-Unplug and try to reboot. If it is still spinning forever, go into target mode again. Navigate to the machine (from the parent machine) and drag your entire /Users/drpynchon directory to the host machine. Unplug, and reinstall the OS, preferably 10.5 is you can swing it.

Between these steps, you can try to reset the PRAM and NVRAM.
posted by four panels at 6:43 AM on December 19, 2008

If you don't have another Mac handy you can still boot from an external drive, as mrbarrett suggests. You can also boot directly from the Diskwarrior CD, but if it can't repair anything you won't have another volume to move recovered files to.

If there are any permissions issues following data copy / recovery nothing stops you from dropping into Terminal and changing them with a sudo chown command. Make it recursive with -R if we're talking entire directories here. So long as you have an admin password you can change ownership / group on anything under the hood.

The ability to boot and see all data isn't Mac specific - you can throw a Linux or WinPE live boot disk into pretty much any computer, start it with a full GUI and have read / read-write access to the entire filesystem. YTMS links to an Apple page telling you how to set up a BIOS password. It blocks anyone from doing much with your system. Note that this still doesn't prevent anyone from cracking the case and stealing your hard drive directly. If someone has physical access to your machine they can get your data. Theoretically, even encrypted data could be recovered if the person doing so had an infinite amount of time to try.

Personally, I rely on system passwords to limit unauthorized access, physical locks (tiedown cables) to stop anyone from easily walking off with my MBP if they have direct access, and physical barriers (locks on doors) to help prevent unauthorized individuals from having direct access to locations in which computers are used. I don't encrypt my data, partly because I move it between multiple systems (MBP at work, WinXP at home, Linux backup server) that each use different methods of securing data. Theoretically it shouldn't matter, as data synced between systems should be decrypted and re-encrypted on the fly, but I still worry about potential data corruption and I really don't want to bother with something cross-platform like TrueCrypt. The second reason I don't really worry about encryption is that I don't work with anything that sensitive; my primary concern is having multiple backups, period, not having multiple secure backups.
posted by caution live frogs at 7:00 AM on December 19, 2008

The problem continues... So I haven't found a second Mac yet to try Target Disk Mode, but I got DiskWarrior and gave it a run from its boot disk. Booted fine, found what seemed like a few minor errors in the directory and repaired that without a problem. Fixed the permissions and checked files/folders successfully as well.

Attempted a boot from the HD and again it froze with the same message in verbose mode. Attempting a safe boot hangs on the apple insignia, and single user mode also hangs prior to giving me a command prompt. Again I can access the drive via the terminal on the installation disk.

Repeated DiskWarrior run and found no problems with the directory, but I successfully rebuilt it anyway. Disk permissions also looked fine.

Gah! Still won't boot from the drive. Tried running the install disk again and again it won't allow Archive & Install and leaves me only with the option of erasing the disk.

What's left? Should I try this reupdate of the system as a target drive or am I toast?
posted by drpynchon at 1:33 PM on December 19, 2008

If the volume's directory is checking out fine, then it's probably a corrupted OS. You should attempt an Archive & Install from the DVD that shipped with this computer. One thought:

Be sure that you're selecting the Options button during the installation that brings up the screen for your three options: Upgrade (if possible), Archive & Install, and Erase & Install. If you're only looking at the screen where it shows the volumes to install onto, the default language will say something about not being able to install the OS because there's a newer version installed.

Aside from that, you might have to back up your data, Erase & Install, then reinstall your Apps and migrate your data back into the new OS. User folders are fairly transferable in these types of situations. I generally create a new user on the new system with exactly the same short username. The default UID will be 501 as this is the UID assigned to the first Admin user account created. Then I copy the contents back into the new User folder one at a time paying particular attention to my /Library and Preferences folders.

Many Applications are portable as well and can simply be copied off and then copied back. There are some exceptions: Adobe, Quark, and a few more that scatter stuff in ~/Library/Application Support. But most are simply drag-n-drop transferable.
posted by mrbarrett.com at 2:08 PM on December 19, 2008

Here's what I would suggest you do. Go to [place to buy a hard drive] and buy a hard drive that's as big as the one in your Mac. Then, plug it up to your Mac and boot off the OS install disk. Open up terminal and run the following command:

sudo cp -Rv /Volumes/old_HD_name/* /Volumes/new_HD_name/

And, tada, you should have a copy of your hard drive on the new one. (Hopefully this works...) Then, erase and install your old HD. Finally, install all updates, make sure it works, then copy back over your files.
posted by 47triple2 at 9:17 PM on December 19, 2008

drpynchon, this isn't a hard drive issue, it's a reported but unfixed issue with 10.4.11 and its upgrades. You can google 10.4.11 and com.apple.driver.AppleUSBTCKeyboard to verify that and see the various ways that people are working around it, although they all involve a second mac.

There is one thread here in which I believe that the script kiddie poster has claimed to have found a workaround for directly repairing the corrupted OS, but it's a pretty verbally-challenged explanation, so a pinch of salt and all that:

http://discussions.apple.com/thread.jspa?threadID=1256262&tstart=50

There is also a statement in that thread that upgrading to Leopard will fix it, although it doesn't look verified to me. I wonder if you could borrow a copy of Leopard from somewhere and try Archive and Install from Leopard rather than Tiger.

It sucks that it was Apple idiocy that caught you up, but Microsoft has also hosed users' installs with upgrades, and if it wasn't a software issue it could have easily been a hardware crash, because: computers. Not excusing Apple from hosing your machine. I hate how they deal with their serious bugs and I think a number of their upgrades post-Intel switchover have had abysmal QA (I have a useless Superdrive due to one of them, which is another widely-reported and unaddressed bug you can see all over the Apple Discussions site). The controllable part is your backup system, and in my experience you are on the right track to commit to a wired disk plus Time Machine.

BTW, once you have this sorted out, I would not make it a high priority goal to make double backups; first of all that wouldn't have changed the situation cited by firstdrop if he or she was using an incremental backup system. But the main reason is that like your NAS, it creates a stumbling block to letting the OS make frequent backups without your intercession, so that when something like this happens you grumble for an hour while you restore your hour-old work and then forget about it.
posted by Your Time Machine Sucks at 5:29 AM on December 20, 2008