Corrupting a hard disk

[markkenny]

Strange request I know, but I want to corrupt the volume header, or file count on a hard disk so I can see the errors.

I had a corrupt hard disk this week and my first reaction was backup (failed), attempt repair with Drive Genius (successful), backup (successful). I had another drive I could not repair or backup, but Data Rescue managed to pull most of the user folder.

So I want to test recovery options, but I need corrupt drives, not with my users data ;-)

How do I do this? Drive Genius Disk editor? Any terminal way to mess with the formatting of a HFS+ drive?

[GabeShack]

I highly recommend Disk Warrior for corruption. I actually loaded this onto our casper imaging netboot for triage. If logged into a root user however you have tell Disk Warrior to load via a resource inside the app (terminal) otherwise it will error out.

Gabe Shackney
Princeton Public Schools

[mpermann]

@markkenny I've never purposely tried to corrupt a hard drive, but maybe you can purposely shut off the computer when you are doing an OS upgrade or moving large amounts of files around. That might cause some corruption in the directory structure. I would think that using the disk editor in Drive Genius could also cause some corruption.

[GabeShack]

Open disk utility and turn off disk journaling. Then hard power it off. Almost guaranteed to cause some corruption.

[gskibum]

I second third fourth and 20th gshackney's recommendation for DiskWarrior for repairing problems. In fact it just repaired a RAID 5/0 volume that Disk Utility couldn't repair.

I've been pondering over how to deliberately damage a volume too. Thank you gshackney for the Journaling trick.

[GabeShack]

Actually found a command to disable journaling on drive.

diskutil disableJournal /Volumes/TheVolumeName

Gabe Shackney
Princeton Public Schools

[markkenny]

I couldn't get Gabes disableJournal to work, said the drive was mounted, so I unmounted, then it couldn't cos it was unmounted. My colleague showed me, run Disk Utility, hold down Alt, click on File, and Disable Journaling. I was running from our Netboot server though, not the boot drive.

A few file copies whilst powering off and I got a nice and corrupt HD.
Now I had HD to test disk verification and creating the extension attribute for reporting.

My script, cobbled together from my JAMFNation searches. Other peoples work who are much clever than I. Someone else had something similar, but it only tailed 1 line, and the word corruption is two lines up. My colleague also tried using fsck, but that doesn't like being run through Casper, so I'm sticking with diskutil

#!/bin/sh
whichdrive=`diskutil list | grep "Macintosh HD" | awk '{print $7}'`
theresult=`diskutil verifyVolume $whichdrive | tail -n 2 `
if [[ $theresult =~ .*corrupt.* ]]; then
    defaults write /Library/Preferences/com.MYCOMPANY.HDCheck Diskverify FAILED;
else
    defaults write /Library/Preferences/com.MYCOMPANY.HDCheck Diskverify PASSED;
fi
exit 0

The script is set to run weekly, and the extension attribute is...

#!/bin/sh
HardiskStatus=`defaults read /Library/Preferences/com.MYCOMPANY.HDCheck Diskverify`
echo "<result>$HardiskStatus</result>"
fi

I have a smart group alerting me to addition of drives that fail for me to intervene.

Still needs some tweaks, possibly putting a repair option in for users, or getting fsck to run. But I'm happy with what we've got, and last week I had three users with corrupt SSD, so I'm happier I can support my users better.

[tnielsen]

Cool stuff Mark Kenny, thank you for sharing.

[markkenny]

So the drive that reported errors, as screenshot in my previous post, when I boot in Recovery Mode, or my Netboot server, the drive reports no issues at all. I need to corrupt another hard drive ;-)

[apizz]

Thanks for your work on this, @markkenny.

I noticed that some of our Macs have Logical Volumes, so when you run grep "Macintosh HD" you get multiple items. I updated the command for the theresult variable in your script to account for this.

diskutil list | grep "Macintosh HD" | tail -1 | awk '{print $7}'