Directory damage and fallout -- looking for root cause

One of the G5s (2x 2.7GHz, 4.5 GB RAM, 250 GB HD) I support at work started exhibiting erratic behavior yesterday (spinning ball, slow app launch, general weirdness) and I told the user to reboot. He did, and the grey pinwheel screen came up and it sat there spinning for a while and then went wind-tunnel with black screen.
I powered it back on and went into single-user mode and did fsck -fy and got a host of errors. Not thinking it wouldn't fix things, I don't remember what the initial errors were, but there were a lot of them. Missing files maybe?
Anyhow, it couldn't repair everything. The errors I then got were:
Incorrect number of thread records (4, 228)
and
Invalid volume file count
I booted with TechTool 4.x and it found errors as well but could not repair. I then bought DiskWarrior and booted up another Mac and plugged the G5 in via firewire disk mode. I rebuild the directory and rebooted the G5 into single user mode and fsck gave me a clean bill of health.
I rebooted again and it passed through the grey screen and "hung" on the blue screen prior to login for about 30 mins before I lost patience and rebooted in verbose mode.
In verbose mode, everything seemed to go well until I got the following message every three seconds...
...waiting for IFC
At that point, I left it to do its thing and came back this morning to the login window.
I then rebooted the machine again and it "hung" on the blue screen again.
Right now I am imaging the internal drive over to another drive. I am just going to rebuild the machine now, but what I really want to know is what is this IFC service that it was waiting for?
(Unfortunately the rebuild will take a while since it has both Adobe CS2 AND Final Cut Pro -- two long installs that require multiple DVD swaps)
--Mike

Michael,
Disk repair utilities, when they work, will return your file system to a "consistent state," but they cannot restore data that may have been lost as a result of the disk error. In other words, even after a successful repair, you may still have damaged files.
If the damaged files happen to be critical system files, the machine "won't go." Period.
The original cause could be one or more of several things. If the user that "rebooted" the machine had to perform a forced shutdown, doing so would only have aggravated the issue, causing further errors and damage. The original cause could have been a bad block on the drive, or it could simply have been a "tired" file system.
If you want to get ahead of the game somewhat, I would recommend that you "zero" the drive (with the drive selected in Disk Utility, not the "volume" on the drive). This will map out any potential bad blocks, thereby eliminating the possible need to go through this again in the near future.
Also, be aware that any "image" of the volume in question will, itself, remain damaged. I would recommend that you attempt to recover only user data from this backup; do not attempt to "restore" it using Disk Utility.
Scott

Similar Messages

  • SBS2011 Recovered from Missing SYSVOL and NETLOGON; looking for original cause - not restore related

    Call from client that they couldn't login to their shares. Connected to the server and found SYSVOL and NETLOGON missing. This has happened 3 times on this server 2014-01-06, 2014-03-26, and 2014-06-04. Although I have documentation and can restore quickly,
    preventing is out primary goal.
    What are the situation is which tis might happen and possible event log items that can give us a warning that this may take place.

    Searched more for SYSVOL NETLOGON Repeat. I excluded the C:\Windows\sysvol directory from Anti-virus scan to prevent locks. Links are below.Thank you,
    Jefferson Eckert
    Systems Engineer | Inline Computer & Communications
    509.783.5450 ext 158 | [email protected] | http://www.inlinecomputer.com
    Please consider the environment before printing this email
    http://blogs.technet.com/b/instan/archive/2009/07/14/what-happens-in-a-journal-wrap.aspx
    Since the PDC server was in Journal Wrap errors state and new DC was not having sysvol share avaialbe to fix the issue you need to first take the backup of sysvol and perfrom D4(authorative restore) and D2(non authorative restore) to fix the issue.http://support.microsoft.com/kb/290762/
    Also your first step should be finding why JRNL_WRAP_ERROR error has occurred. Normally, JRNL_WRAP_ERROR occurs due to drive/partition being corrupted, antivirus locking and corrupting the file during sysvol scan, heavy size of the files inside
    sysvol and netlogon shares.
    Run chkdsk in read only mode for any errors and if issue reported take the backup of server and run chkdsk/f.Exclude the sysvol/nrtds/sysvol from AV scan too.To fix the Journal wrap perfrom authorative restore assuming you have single DC.See below link too.
    what-happens-in-a-journal-:http://blogs.technet.com/b/instan/archive/2009/07/14/what-happens-in-a-journal-wrap.aspx
    Since you have restored the DC to previous state check the health of DC by running dcdiag /q and also check event log for any errors and warning and post the same if any.
    Best Regards,
    Sandesh Dubey.
    MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator |
    My Blog
    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Proposed as answer by
    VenkatSP<abbr class="affil"></abbr> Tuesday, November 20, 2012 2:02 AM

  • I desperately to uninstall adobe reader from my Mac book air. I sent adobe reader to trash and afterwards look for internet plugs in in library but the folder is empty. Can anybody help me?

    I desperately need to uninstall adobe reader from my Mac book air. I sent adobe reader to trash and afterwards look for internet plugs in  library but this folder is empty in my library. Can anybody help me?

    I looked for plugs in in my library but the folder internet plugs in is empty

  • HT5731 How can I download my TV episodes to my Macbook Pro. I bought them from my iPad2, and I looked for them with the same AppleID on iTunes Store and they wont download to my iTunes.

    How can I download my TV episodes to my Macbook Pro. I bought them from my iPad2, and I looked for them with the same AppleID on iTunes Store and they wont download to my iTunes.

    What country are you in ? Depending upon what country that you are in then you might be able to redownload them on your Mac's iTunes via the Purchased link under Quicklinks on the iTunes store homepage
    If you're not in a country where TV programmes can be redownloaded then connect the iPad to your Mac's iTunes and use the File > Devices > Transfer Purchases to copy them over from your iPad

  • I want to set up 5 different ipods to sync from one library, but want to be able to control what is synced to each ipod and have it remember that for future synching and just look for new songs and not sync all the other music in the library

    I want to set up 5 different ipods to sync from one library, but want to be able to control what is synced to each ipod and have it remember that for future synching and just look for new songs and not sync all the other music in the library

    Click here for options.
    (58961)

  • I teach neuroanatomy and am looking for an app that would allow me to use a stylus on the iPad to label a wordforMac or powerpoint document.  Any suggestions?

    Help needed:  I teach neuroanatomy and am looking for an app that would allow me to use a stylus on the iPad screen to label diagrams in wordforMac or powerpoint format. Any suggestions?

    I don't believe it will open a Word document, but Writepad allows for handwritten conversion of notes to text and then to email. Might help you some of the way...

  • I was given an iMac without iPhoto. Have updated to OS to 10.6.8. How do I get a version of iPhoto that will the updates will work with? Downloaded 9.2.1 and it looked for 9.1; downloaded 9.1 and it looked for 9.0??

    I was given an iMac without iPhoto. Have updated to OS to 10.6.8. How do I get a version of iPhoto that will the updates will work with? Downloaded 9.2.1 and it looked for 9.1; downloaded 9.1 and it looked for 9.0??

    You can Purchase iPhoto in the Apps Store...

  • I am trying to migrate from macbook to a new imac and the looking for source keeps spinning

    I am trying to migrate from macbook to a new imac and the looking for source keeps spinning

    The warranty entitles you to complimentary phone support for the first 90 days of ownership.

  • I have a touchsmart 310 and am looking for a wall mount. What type do I need?

    I currently have a TouchSmart 310 and am looking for a wall mount.  Every site I check only seems to have the adapter for the 310, but the entire kit for the 600 and 9100 series.  I am unsure what to purchase.  Please help.

    Have you looked at the http://www.iversal.com adapter? you just use that and any standard VESA wall mount with it.

  • I have an Apple Retina Pro Notebook and am looking for the most highly recommended compatible wireless printer.  Do you have any recommendations?

    I have an Apple Retina Pro Notebook and am looking for the best compatible wireless printer to use with it.  Do you have any recommendations?

    "WiFi Wireless Printer" seems to give Users the feeling that they somehow print directly from their computer to the Printer. That is NOT how it works.
    To make a WiFi Wireless Printer work, you need to make it a participant on your network, by providing the Network_name and the Password. It then becomes a peer of your MacBook on your home Network, and you can create a Print Queue for it in Add-a-Printer.
    There is no particular advantage to this over, say, an Ethernet Printer -- except that you don't have a Physical cable to string.

  • I could not update my apps on my phone this morning,it told me my account was locked for security reasons ??to vist iforgot and reset my account and its looking for all my details again ,i have credit in my account,can you help

    i could not update my apps on my phone this morning,it told me my account was locked for security reasons ??to vist iforgot and reset my account and its looking for all my details again ,i have credit in my account,can you help

    Apple ID- "This Apple ID has been disabled for security reasons" alert appears

  • HT1688 I had a iphone and downloaded a (paid for) app and now looking for it to put on my ipod..cant find it

    I had a iphone and downloaded a (paid for) app and now looking for it to put on my ipod..cant find it now to replace the app it is showingit costs $14.99.

    Usually if you press buy it then it will pop up a screen saying you have already purchased this item, would you like to download it again. You can also click on the purchased tab in the app store on your iPod provided you are using the same apple id that you use on your phone.

  • I've purchased Elements 13 and am looking for the Elements + download. exe?

    I've purchased Elements 13 and am looking for the Elements + download. exe?

    Downloadable installation files available:
    Suites and Programs:  CC 2014 | CC | CS6 | CS5.5 | CS5 | CS4, CS4 Web Standard | CS3
    Acrobat:  XI, X | 9,8 | 9 standard
    Premiere Elements:  13 | 12 | 11, 10 | 9, 8, 7 win | 8 mac | 7 mac
    Photoshop Elements:  13 |12 | 11, 10 | 9,8,7 win | 8 mac | 7 mac
    Lightroom:  5.7.1| 5 | 4 | 3
    Captivate:  8 | 7 | 6 | 5.5, 5 | 1
    Contribute:  CS5 | CS4, CS3 | 3,2
    FrameMaker:  12, 11, 10, 9, 8, 7.2
    Download and installation help for Adobe links
    Download and installation help for Prodesigntools links are listed on most linked pages.  They are critical; especially steps 1, 2 and 3.  If you click a link that does not have those steps listed, open a second window using the Lightroom 3 link to see those 'Important Instructions'.

  • Tools for root cause analysis of stack corruption?

    I'm experiencing extremely rare stack corruption that results in SEGV core dumps for a large and complex C++ program. Having run all the standard tools such as IBM Rational Purify, Sun mdb/libumem and dbx/rtc (although unfortunately using dbx check -access takes inordinately long and eventually crashes before the main() function is executed), I am no closer to discovering the root cause of the stack corruption. I'm confident based on the tools run and on the stack trace from the core dump that the problem is not heap corruption, but stack corruption.
    The environment is Sun Studio 12 (but not update 1) on Solaris 10 on SPARC. The program is compiled with minor optimisation (-xO2 -xbuiltin=%all).
    Is anyone aware of other tools or approaches that could help pinpoint the problem? Your help would be much appreciated!
    Thanks in advance,
    Simon

    If you are in fact having stack corruption issues, I don't think any of the tools you mentioned other than Purify would help you identify it.
    You may also be simply running out of stack space, and not having corruption issues. Is your app multi-threaded? If so, you could increase the stack size your threads use to something larger than the default.
    Another thing you can look for are syslog entries stating "no swap space to grow stack" for your process, you've run out of virtual memory. To avoid this, you can "pre-allocate" your stack memory with code similar to this:
    void growStack( size_t bytes )
        char *mem = ( char * ) alloca( bytes );
        memset( mem, 0, bytes );
        return;
    }That code, when called, will force the creation of stack memory virtual pages backed by swap, before your server gets into a situation where free memory might be in short supply.
    I also seem to recall that Solaris under certain circumstances will allocate stack memory with the MAP_NORESERVE option, which means swap space won't be reserved for your stack. If your process gets swapped out, its stack(s) will be lost and you'll probably get a SIGSEGV or SIGBUS. See this bug:
    [http://bugs.opensolaris.org/view_bug.do?bug_id=1221729|http://bugs.opensolaris.org/view_bug.do?bug_id=1221729]
    I remember working a similar issue for a customer running large apps on Sun E15Ks, maybe about 5 years ago. To work around this behavoir, I think you'll need to explicitly allocate stack memory for any threads you may be creating. I think that's what we had to do.

  • Where to Look for Crash Causes

    Hi,
    G5 for 3 years; rock solid. Don't recall installing anything unusual (other than Apple SW updates) but twice now in the last week I have retunred to the system after being at work to find screen turned off and fans at full pelt. In the early days when I had a couple of kernel panics I knew where to look for the logs. I havce investigated every log (from System Profiler) for both of these "meltdowns" but can't find any reference at all.
    How do I go about pinpointing the cause?
    David
    PS: Apologies in advance - cross posting in OSX and G5 because I don't know which is the most relevant?

    Just to answer my own question. Found this in system log, and these are the last entries before the reboot:
    ================================================
    Jun 27 11:26:14 David-Thorpes-Computer ntpd[160]: time set -0.943959 s
    Jun 27 11:31:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 352 bus resets in last minute.
    Jun 27 11:34:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 344 bus resets in last minute.
    Jun 27 11:38:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 351 bus resets in last minute.
    Jun 27 11:41:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 341 bus resets in last minute.
    Jun 27 11:44:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 356 bus resets in last minute.
    Jun 27 11:47:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 352 bus resets in last minute.
    Jun 27 11:48:19 David-Thorpes-Computer kernel[0]: Bad SelfID packet 4: 0x0 != 0xffffffff!
    Jun 27 11:50:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 362 bus resets in last minute.
    Jun 27 11:54:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 356 bus resets in last minute.
    Jun 27 11:57:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 361 bus resets in last minute.
    Jun 27 12:00:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 363 bus resets in last minute.
    Jun 27 12:03:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 362 bus resets in last minute.
    Jun 27 12:06:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 356 bus resets in last minute.
    Jun 27 12:10:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 356 bus resets in last minute.
    Jun 27 12:13:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 353 bus resets in last minute.
    Jun 27 12:16:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 359 bus resets in last minute.
    Jun 27 12:19:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 362 bus resets in last minute.
    Jun 27 12:22:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 364 bus resets in last minute.
    Jun 27 12:26:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 363 bus resets in last minute.
    Jun 27 12:29:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 365 bus resets in last minute.
    Jun 27 12:32:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 366 bus resets in last minute.
    Jun 27 12:35:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 368 bus resets in last minute.
    Jun 27 12:38:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 359 bus resets in last minute.
    Jun 27 12:42:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 359 bus resets in last minute.
    Jun 27 12:45:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 363 bus resets in last minute.
    Jun 27 12:48:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 360 bus resets in last minute.
    Jun 27 12:51:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 360 bus resets in last minute.
    Jun 27 12:54:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 358 bus resets in last minute.
    Jun 27 12:58:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 366 bus resets in last minute.
    Jun 27 13:01:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 357 bus resets in last minute.
    Jun 27 13:04:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 366 bus resets in last minute.
    Jun 27 13:07:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 364 bus resets in last minute.
    Jun 27 13:10:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 355 bus resets in last minute.
    Jun 27 13:14:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 364 bus resets in last minute.
    Jun 27 13:17:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 364 bus resets in last minute.
    Jun 27 13:20:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 360 bus resets in last minute.
    Jun 27 13:23:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 368 bus resets in last minute.
    Jun 27 13:26:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 363 bus resets in last minute.
    Jun 27 13:30:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 355 bus resets in last minute.
    Jun 27 13:33:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 359 bus resets in last minute.
    Jun 27 13:36:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 357 bus resets in last minute.
    Jun 27 13:39:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 361 bus resets in last minute.
    Jun 27 13:42:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 360 bus resets in last minute.
    Jun 27 13:46:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 367 bus resets in last minute.
    Jun 27 13:49:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 367 bus resets in last minute.
    Jun 27 13:52:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 363 bus resets in last minute.
    Jun 27 13:55:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 362 bus resets in last minute.
    Jun 27 13:58:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 360 bus resets in last minute.
    Jun 27 14:02:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 356 bus resets in last minute.
    Jun 27 14:05:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 364 bus resets in last minute.
    Jun 27 14:08:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 360 bus resets in last minute.
    Jun 27 14:11:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 353 bus resets in last minute.
    Jun 27 14:14:59 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 356 bus resets in last minute.
    Jun 27 14:18:11 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 363 bus resets in last minute.
    Jun 27 14:21:23 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 367 bus resets in last minute.
    Jun 27 14:24:35 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 367 bus resets in last minute.
    Jun 27 14:27:47 David-Thorpes-Computer kernel[0]: FireWire (OHCI) TI ID 8025 PCI: 363 bus resets in last minute.
    =============================================
    Now, a couple of weeks ago I installaed a Lacie PCI Firewire 800 card and attached three Lacie FW 800 drives (previously these were all daisy-chained off the one FW 800 port on the G5 and have worked without issue for two to three years).
    Could these messages be a cause of the crash? Anybody know what they might mean?
    David

Maybe you are looking for