Home Forums Hardware Mac Desktops & Notebooks iMac thinks it is new machine

I've always been an experimenter, so I'd love to give nuke & pave a shot just to see how it works out.

This is the first step by step documented drive failure on FTM in looong time, if ever.

If I can insert a few queries…..

Hardware issue or file corruption?

Using Recovery Disk Utility disk repair doesn’t find anything wrong with the Macintosh HD. It only identifies issues (warnings) with Macintosh HD – Data.

EtreCheck Pro (run a few times), only lists Unsigned Files as Major Issues.

Is the multitude of warnings actually a multitude?

What appears to be a multitude of warnings is actually three warnings repeated in several places. They are:

warning: inode (id 52008953): Resource Fork attr is missing for compressed file

warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)

warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

The above warnings appear once in each of the Snapshots and again under the heading: Checking the fsroot tree.

Fake fix?

In the Disk Utility (First Aid), corruption is identified and appears to be repaired.

The volume /dev/rdisk/rdisk3s1 with UUID E3E74E64-3E84-4385-9FFB-4E732D7F75F5 was found to be corrupt and needs to be repaired.
Verifying allocated space.
Performing deferred repairs.
The volume /dev/rdisk/rdisk3s1 with UUID E3E74E64-3E84-4385-9FFB-4E732D7F75F5 appears to be okay.

However, if I go back into Recovery, and run the Disk Utility First Aid again, it repeats the same information. i.e. problem identified and repaired. What?

Nike and Pave

I'm not rejecting the idea but my concern here is that, if the files are corrupted and I use Time Machine to restore them, will I just be reinstalling the existing corruption(s)?

Would I be better off to spend the dough on something like TechTool Pro, which might be able to repair the corrupted files?

Sonoma Installation

Going forward, whatever solution is determined, I have decided I may as well stay with Sonoma. It appears to be working just fine and is, in fact, a bit faster than Ventura.

Etrecheck Pro does not perform any directory or file checks except unsigned executable (program) files and that simply means the developer is either tardy in following Apple's security verification or is not longer supporting the particular executable.

it is the fact they continue to grow which indicates the issue is spreading. If this were hard drive it would indicated the recording surface is flaking off the disk.

Those are directories and means there are probably lost files because the pointers to their location has been lost.

I haven't seen that in years, but it used to be pretty common. It would imply that DU was fixing the problem by writing to spare sectors on the drive and the fix for whatever reason was not holding. An application that reports complete S.M.A.R.T. or NVME values is needed to perform further diagnosis.



Would I be better off to spend the dough on something like TechTool Pro, which might be able to repair the corrupted files?[/quote] TTP is one of the apps that offers full S.M.A.R.T. and NVME reporting but it may cost more than a new drive but no application can repair damaged hardware.

TechTool was less than a drive so I got it. I’ve run pretty much all the tests (including the S,M.A.R.T. test) and everything passed with flying colours. I also re-ran the Disk Utility First Aid but nothing has changed. There is, however, an interesting note in Snapshot 1.

Warning: snapshot fsroot / file key rolling / doc-id tree corruptions are not repaired; they’ll go away once the snapshot is deleted

Question: Should I delete this snapshot? TTP gives the ability to delete.



Other info:

• Any “File Structure” tests don’t say “Passed”, they say “Checked”

• A File Structure test of Macintosh HD – Data says: “No suspect files found” (This is the Volume that Disk Utility says is full of warnings)

• A Volume Structure test of Macintosh HD – Data says: “No validation errors encountered”

No reason not to delete the snapshot, another will replace it, probably sooner rather than later.

The incongruity between TTP and DU remains inexplicable and concerning. TTP reports the full range of S.M.A.R.T. and NVME values for all your drives. I would be very interested in what those values are indicating. Could you run the report and post the results here or on Imgur so we can see it? A screenhot of the DU results would also be helpful.

Using TechTool Pro, early “File Structures” tests on all drives showed 15 or 16 issues of two types:

• Unexpected character P at line 1
• File is not a valid image file

These faults were on all drives and I physically removed them from all drives except Time Machine. Since then, none of the drives, including TM, show the faults.

I removed the first Snapshot but it did not cause the "snapshot fsroot / file key rolling / doc-id tree corruptions" issue to go away.



Disk Utility First Aid still shows warnings, although the number of Snapshots has been reduced to 9 while the number of warnings in each Snapshot has been increased to 5.

Running First Aid on "Macintosh HD - Data" (disk3s1)

Checking file system and repairing if necessary and if possible.
Volume was successfully unmounted.
Performing fsck_apfs -y -x /dev/rdisk3s1
Checking the container superblock.
Checking the checkpoint with transaction ID 4122858.
Checking the EFI jumpstart record.
Checking the space manager.
Checking the space manager free queue trees.
Checking the object map.
Checking the encryption key structures.
Checking volume /dev/rdisk3s1.
Checking the APFS volume superblock.
The volume Macintosh HD - Data was formatted by diskmanagementd (1934.101.3) and last modified by apfs_kext (2235.60.6).
Checking the object map.
Checking the snapshot metadata tree.
Checking the snapshot metadata.

Checking snapshot 1 of 9 (com.micromat.techtoolpro.2023-12-30-101243.local) warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: snapshot fsroot / file key rolling / doc-id tree corruptions are not repaired; they'll go away once the snapshot is deleted
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking snapshot 2 of 9 (com.apple.TimeMachine.2023-12-30-120856.local)
warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file
warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants 6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking snapshot 3 of 9 (com.apple.TimeMachine.2023-12-30-131327.local)
warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file
warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking snapshot 4 of 9 (com.apple.TimeMachine.2023-12-30-150437.local)
warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file
warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking snapshot 5 of 9 (com.apple.TimeMachine.2023-12-30-160523.local)
warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file
warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking snapshot 6 of 9 (com.apple.TimeMachine.2023-12-30-170605.local)
warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file
warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking snapshot 7 of 9 (com.apple.TimeMachine.2023-12-31-080205.local)
warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file
warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking snapshot 8 of 9 (com.apple.TimeMachine.2023-12-31-094455.local)
warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file
warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking snapshot 9 of 9 (com.apple.TimeMachine.2023-12-31-110107.local)
warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file
warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking the document ID tree.
Checking the sroot tree.
warning: inode (id 52008953): Resource Fork attr is missing for compressed file
warning: inode (id 52181829): Resource Fork attr is missing for compressed file
warning: inode (id 52290078): Resource Fork attr is missing for compressed file
warning: descendants (215) of dir-stats object (id 3086799) is greater than expected (193)
warning: descendants (6318) of dir-stats object (id 4344528) is greater than expected (4469)

Checking the extent ref tree.
Verifying volume object map space.
The volume /dev/rdisk31 with UUID E37464-384-4385-9FFB-4E732D7F75F5 was found to be corrupt and needs to be repaired
Verifying allocated space.
Performing deferred repairs.
The volume /dev/rdisk3s1 with UUID E3E74E64-3E84-4385-9FFB-4E732D7F75F5 appears to be OK.
File system check exit code is 0.
Restoring the original state found as mounted.

Operation successful.



The above results disagree with TechTool Pro, which says:.

File Structures – Macintosh HD Data
Volume:
Macintosh HD - Data (1 TB)
CHECKED
No suspect files found.


Volume Structures – Macintosh HD Data
Volume:
Macintosh HD - Data
PASSED
No Validation Errors Encountered


Volume Rebuild – Macintosh HD Data
Volume:
Macintosh HD - Data
COMPLETED
No Rebuild Errors Encountered




Running Disk Utility First Aid on the main HD doesn’t show any problems, which agrees with TechTool Pro results.


File Structures – Macintosh HD
Volume:
Macintosh HD (1 TB)

CHECKED
No suspect files found.


Volume Structures – Macintosh HD
Volume:
Macintosh HD - Data

PASSED
No Validation Errors Encountered


Volume Rebuild – Macintosh HD
Volume:
Macintosh HD - Data

COMPLETED
No Rebuild Errors Encountered


SMART Check
Device:
1 TB APPLE SSD AP1024N
C021344007R00NYAU

PASSED

Available Space Below Below Threshold : No
Over Temperature Threshold : No
NVMe Subsystem Reliability Degraded : No
Media In Read Only Mode : No
Volatile Memory Backup Device Failure : No
Available Spare : 100%
Available Spare Threshold : 99%
Percentage Remaining : 100%
Percentage Used : 0%

Does TechTool test hardware other than drives? You could have something else going bad.

I haven't scrolled back through all the posts, but I suggested using Apple's Hardware Diagnostics awhile back. Did everything pass?

Not sure if TechTool test anything other than drives. However, the only things I have other than drives are my Scanner, my Printer and my Anker USB distribution device. Other than the Anker, they are turned off unless in use..... so, most of the time.

Apple's Hardware Diagnostics gave a thumbs up (quite quickly, actually) which agrees with both First Aid and TechTool Pro.

If you created an eDrive and ran TTP while booted from it, the tests are reliable, but any test of the current boot volume, whether it is by Disk Utility or TechTool Pro, is subject to error and therefore suspect. MacOS goes to great lengths to hide and protect the boot volume from anything that might affect it. That is also why you run DU from the Recovery Drive when testing the boot volume ie. Macintosh HD which includes both the Data and System volumes.

You can, however, look at the NVME and SMART hardware reports while booted from a drive and get accurate results that, properly analyzed, will give a decent picture of the drive's current health, early warning of problems, and potential longevity. To me, that is perhaps the best feature of TTP.

Snapshots are essentially historical images of the system as they existed at prior moments in time. You can learn from history, but no matter how hard you try, you cannot change it. Snapshots are the basis of Time Machine and are copied to the Time Machine drive. A limited number will be kept on the hard drive for a few hours and can be used by apps for file versioning.

Can’t be an eDrive. According to the TTP manual…. “Intel Macs running macOS 12 “Monterey” and later require operating systems to be signed by the macOS installer, which means that the eDrive tool is not supported on these Macs. As such, the eDrive tool is unavailable in the Tools Selection on Apple Silicon Macs and all Macs running Monterey and later.

In this situation, the best solution is to download the current macOS installer from the App Store and install macOS onto a freshly formatted external drive. After installing macOS, create a new user but do not migrate user data or applications from another startup disk or Time Machine disk. After setting up the new account, download and install TechTool Pro and any other desired utilities to complete your emergency diagnostic disk.”

Do I assume a bootable thumb drive would be okay?

I suppose that would explain why the faults “Unexpected character P at line 1” and “File is not a valid image file” appeared to be in only one Snapshot on the Time Machine drive. (No, I didn’t mess with the TM drive)

D3mn! The eDrive was one of the most useful features in TTP! But YES a bootable thumb drive will work so long as you have also installed TTP on it.

In a word YES and I did not think you had messed with the listing, rather that you were unclear on the concept -- which probably places you among the vast majority of users. If you haven't read the previously referenced Rocket Yard blog on snapshots, I urge you to do so. It is the best and clearest article I have found on APFS snapshots and how they are integrated into the Time Machine process, although a bit dated.

The snapshots you listed are all on your boot drive and will age off at the rate of one each hour only to be replaced by the newest snapshot. "Time Machine" in the listing indicates the application that triggered the system to create the snapshot, not where the file was located. (Notice that snapshot 1 of 9 was triggered by Techtool pro (probably as a safety feature before running any repair routine, a brilliant precaution in my opinion.)

Just by way of clarification here, the TTP instructions sound like they're talking about, NOT a bootable thumb drive in the sense that has been previously discussed, BUT an external volume with a fresh installation of macOS which includes TTP.

Or is either option a suitable workaround for the problem at hand?

Interesting article!

But I don't use Time Machine, so in that sense, it's of no use to me, How, though, does it relate to my Carbon Copy Cloner snapshots?

They are created using the same macOS utility differing only in the identifier of the app that triggered the utility and are otherwise identical and can be used in the same way, regardless of the triggering app. Only those created by Time Machine go into a Time Machine backup. CCC does have rudimentary tools for recovering from a snapshot, but I have not used them.

So there are no equivalent Terminal commands...only CCC's built-in mechanism.

It may be that TechTool Pro is the only software providing accurate information. Disk Utility identified a number of warnings which, I assume is less scary than identifying a number of errors, but TechTool Pro said: "nothing here to worry about".

I talked with a senior technician at Apple today who also said "nothing here to worry about". The technician chalked the errors up to issues with Disk Utility still not being able to deal properly with APFS files and provided this dated link.

I asked about the 'fixed/not fixed' message that is at the end of every Disk Utility report.

The volume /dev/rdisk31 with UUID E37464-384-4385-9FFB-4E732D7F75F5 was found to be corrupt and needs to be repaired
Verifying allocated space.
Performing deferred repairs.
The volume /dev/rdisk3s1 with UUID E3E74E64-3E84-4385-9FFB-4E732D7F75F5 appears to be OK.

I asked: If it was being repaired successfully as reported, why did it keep coming back? The tech ran the same test on a nearby Mac and got exactly the same result.

After the call, I DuckDuckGoed "warning: inode (id 52008953): Resource Fork attr is missing for compressed file" and it turns out to be quite common. So, I'm going to stop worrying about the 'warnings' and cross my fingers that Apple will update Disk Utility.

I don't have access to the CCC code to see specifically how CCC creates snapshots, but Time Machine uses terminal commands and I can't imagine why Mike Bombich would not take advantage of such a valuable resource. Certainly, Micromat did as witnessed by snapshot 1 of 9 in Ryck's report.
I also know that Tinkertool System is a GUI interface for command line utilities and provides essentially the same rudimentary manipulation features in its APFS pane regardless of what app triggered the snapshot's creation. Interesting sidelight, TTP also identifies CCC created snapshots as Time Machine snapshots even though the snapshot filenames are prefixed by com.bombich.ccc

FYI the terminal command for creating a snapshot is I will leave it up to you to sort out all of the options.

My question was poorly phrased.

What I was wondering was whether you were aware of the specific Terminal commands that CCC runs and whether they're customizable, but I guess that's Mike's proprietary info.

I am still a bit confused.

• The only terminal command that creates snapshots is tmutil, so it is highly probable that is the one Mike uses.
• Virtually all terminal commands, including tmutil, have a number of verbs and options to customize, or control, its operations. (The difficulty can be finding out which command does what you want.)
• All the details of tmutil are found by typing
  Code

  man tmutil

  at the terminal command prompt and pressing return. (Interpreting the manual is a bit more complicted )
• The contents of the tmutil manual are open source and can be used by anyone.
• The specific set of verbs and options Mike uses in CCC would be covered under the CCC copyright, as would any other commands in the script that does any pre- or post-processing.
• In the final analysis an APFS snapshot is a snapshot, if it is to be usable in macOS.

Thanks for setting me straight. I think we're in the same ballpark now.

I didn't realize that tmutil was a "universal" command, and Mike's specifics are, of course, not public.

I'm conversant with the man pages, but I don't see any purpose in engaging with them as respects CCC.