Data Recovery Case File · Mac & Apple Ecosystem · Bypass the Filesystem

The Copy Is Crashing the Computer

His enquiry describes a drive the system says he can still use, in a way that demonstrates he cannot. A 16TB drive: "when I connect it to my Mac it comes up with a message saying the drive cannot be repaired and to back up the data and format the drive as soon as possible. I am still able to read the drive and the error message claims I can still copy — but when I try to copy the data to an empty drive, my Mac restarts and the copying process is halted." He has done everything right, including having a destination ready. The restart is the finding, and it means the advice in the message cannot be followed.

The decode: why the machine restarts, and the layer to work at

What a restart during a copy actually is: not the machine giving up. A computer that reboots itself partway through an operation has suffered a fault in code running at the deepest level of the system — in this case the filesystem driver, the component that interprets the volume's structures. When that code encounters something it was not written to survive, the system cannot continue safely and restarts.

Why that means the structures are the problem: the driver is being handed a directory entry, an allocation record or an attribute that is malformed in a way it cannot handle — an impossible length, a circular reference, a value outside any legitimate range. Reading the data is not what fails; parsing the description of it is. His files are fine and the map is dangerous.

Why the system's own advice cannot be followed: the message tells him to back up the data and then reformat, which is entirely sensible guidance for a volume that is failing but usable. It assumes copying works. Here copying is the operation that triggers the crash, so the instruction is self-defeating — and every attempt at it is another unclean restart of the machine, which is its own risk.

What to do instead, and it is the same principle that appears throughout this archive: work at a layer that asks less. Imaging reads the drive as a sequence of sectors and never interprets the filesystem at all, so the malformed structures are copied as data rather than parsed as instructions — and nothing crashes, because nothing is trying to understand them. The image is then examined on a system where a wrong interpretation costs nothing, the structures repaired against the copy, and the files extracted from the repaired version.

Why his empty drive is exactly what is needed: a 16TB source needs a destination of at least that size, and he has one ready. That is the single most useful piece of preparation anybody brings to a case this size.

What not to do: not accept the offer to repair, since the utility that already declared the volume unrepairable would be writing conclusions drawn from structures that crash a driver. Not reformat. And not keep retrying the copy, since each attempt is an abrupt restart of a running machine.

On the bench

File-level copying was discontinued, since the operation faults the host's filesystem driver and each attempt is an unclean restart of a running machine. The drive was imaged write-blocked at block level with host filesystem handling bypassed — sectors read as data with nothing interpreting the malformed structures, which is precisely why capture succeeds where every copy had crashed. Structures were reconstructed on the image, where a wrong interpretation costs nothing and can be repeated, and files extracted from the reconstructed image and validated by opening.

The outcome

The copy abandoned, the drive imaged at block level with filesystem handling bypassed, and files extracted from the reconstructed image. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone whose machine restarts during a copy: that is a fault in the filesystem driver rather than the machine giving up. Your files are readable and the structures describing them are malformed in a way the code cannot survive parsing. So the system's own advice to back up and reformat cannot be followed — imaging reads sectors without interpreting anything, which is why it works.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.