Evil hard drive that crashes systems on read.

[mattspace]

OK, where would folks look to try to figure this one out...

Woke up this morning, my fileserver Mac Mini was at the login screen, it had obviously rebooted in the night. Logged in, and drives were missing. Attempting to reboot resulted in a boot loop.

By process of elimination I have isolated one particular drive which seems to be the problem.

Connecting that drive to a different machine, in a different external case - the moment the machine tries to read the drive as it spins up, the machine kernel panics and reboots.

So far this has been on older machines running High Sierra, and frankly I'm not game to plug it into my Ventura workstation. The real question is, how do you troubleshoot, or run diagnostics on something that kills the system the moment it even looks at it?

Booting in Safe mode didn't change things. Booting first, then plugging the drive in has the same effect, system dies the instant it starts reading the drive. It's kinda spooky.

Thoughts?

 

[Nermal]

What filesystem is it? Could you try it on a Windows machine or is it in a Mac-specific format?

 

[mattspace]

What filesystem is it? Could you try it on a Windows machine or is it in a Mac-specific format?

It's HFS+ It doesn't kill an iPad on iPadOS 16 when connected to it, but it also doesn't mount as a drive. Tried a diffeent drive in the same case and it mounts OK on the iPad.

 

[mattspace]

OK so here is some more information for anyone who ever sees this problem - I've installed an app call Disk Arbitrator - it's a forensic app that lets you intercept the disk before the system mounts it, and then mount it as read-only and NOT replay the HFS+ journal.

That got the disk mounted and readable. So it seems the problem is a corrupt journal - which would even cause a kernel panic if I tried to run Disk Util's first aid on the disk (presumably because FSCK is checking the journal to start.

So now I'm recovering the data with Chronosync to another drive, and we'll see if the original can be reformatted without panicing the system.

 

[BrianBaughn]

Good info. Let us know if it works.

There's always the possibility that the drive's housing electronics may be an issue…glitched and caused the corruption.

 

[BrianBaughn]

Oh…and how did you determine that "the problem is a corrupt journal"?

 

[mattspace]

Good info. Let us know if it works.

There's always the possibility that the drive's housing electronics may be an issue…glitched and caused the corruption.

The problem travelled with the drive between housings and machines, so it's specific to the drive.

Oh…and how did you determine that "the problem is a corrupt journal"?

It's a working theory based upon the fact the drive is mounting, and readable when Disk Arbitrator is set to ignore the journal. 🤷‍♂️