A day in the life II random header image

Drive-by Geek Forensics: I didn’t know I was your hardware tech!

June 1st, 2008 by Malcolm

So my sweetie’s Powerbook G4 is having some performance and operation problems, and I just thought I’d take this opportunity to talk about what the symptoms appear to be and what what our action plan is to get it back into operation.

Updated to make certain decision-points a little clearer.

Updated 2 with alterations suggested by ckd, some wording corrections and some price estimates.

Symptoms (note that these issues are not Apple-specific):

  • First noted: Months ago. General performance problems.
  • Progressively more difficult to shut down normally.
  • Progressively slower boot times.
  • Some tasks freeze up the computer entirely and the computer has to be hard cycled (i.e. power button held down until hard shutoff, or worse, battery and power supply removed)

Troubleshooting:

  • General attempts at computer maintenance
  • On a PC, I would sometimes do a scan of the hard drive with checkdisk and also attempt defrags, but Apples do a dynamic defrag, and I don’t know how to kick off a manually-asserted checkdisk type scan. Warning: Sometimes on a PC, the checkdisk and defrags can automatically “fix” stuff for you, which is not always advantageous. Do consult with a paid geek or a friend-geek-who-knows-what-e’s-doing before doing either with an ailing PC drive.
  • Given the laptop still boots and still sort of works, we downloaded ClamXav last night and ran it overnight. ClamXav’s a free, open source virus scanner. At some point the hard drive started thrashing and we woke up with the system completely frozen (mouse wouldn’t move the pointer).

Recovery planning:

At this point I’m comfortable saying we need to treat it as a hard disk failure no matter what (essentially because this makes the most sense and because doing the forensics and data recovery will save our data as completely as possible even if replacing the drive doesn’t work).

My sweetie’s been pretty good at backups (the most recent, with SuperDuper, is probably about a month old) and since we declared a critical situation with the Powerbook, she’s managed to save off active documents to either Google Docs or thumbdrives, so we’re looking at, at worst, probably a month’s lost data in her downloaded POP3 email data. (Yay!)

Given SuperDuper’s ability to boot off of its backups directly, she could test her recent backup by booting from it, and she may, but I think she’s chosen to just use her new EeeePC, concentrate on the upcoming household move, and then deal with this issue when we’re done. That’s fine. As long as the Powerbook stays off, the drive issues shouldn’t get any worse.

Long term planning:

Important assumptions:

  • We have a last known-good SuperDuper backup on an external drive and that stays relatively untouched, though it might be a good idea to boot off of it just to make sure it’s still good.
  • New recovery utilizes other hardware. This is a rule. You don’t want to sacrifice a known-good backup for a new backup off of unreliable hardware.
  • When a hard drive fails, it’s a good idea to get an external enclosure for it. This means that you may be able to recover more files from it at a later date, when you want to try it. Do this (if you can afford it) for any drive that’s not completely toast/bricked/non-functional.
  • The Powerbook is totally out of warranty. I can do my own repairs without violating any warrantees. If your computer is under warranty, pay the nice Apple geeks to do the work for you. Violating warrantees is bad.
  • While I’m in there, if I can get a new keyboard for the Powerbook, I should replace that too. Looks like I can. Here’s a representative site, but I haven’t actually bought from them so I can’t say whether they’re good. Appropriate keyboard’s around US$100.
  • The same goes for the trackpad. Can get from the same place but since it’s integrated into part of the case, it’s around US$230. For this I’m more inclined to go with other 3rd party peripherals. We’ll see.
  • The guideline, though, is change as little as possible in each step, so yes, during the day(s) that I’m gutting/replacing things, I will also fix the keyboard/trackpad (if possible), but first I fix the hard drive, then I fix the keyboard, then the trackpad.
  • So that means we need:
    • The original Mac OS X CD/DVD that came with the system (for safe, reliable, virus-free booting). (free)
    • 1 new external hard drive with capacity that matches or exceeds the current (bad) internal drive in the powerbook (i.e. greater than or equal to 60 GB) (~US$80 for 60GB - ideal price point may be a slightly higher capacity at this point)
    • 1 new empty external enclosure for the current (bad) internal hard drive in the powerbook (~US$30? - brand matters least since this is sort of a throw-away application)
    • 1 new Powerbook G4 compatible (i.e. ATA/IDE/EIDE, 2.5″ (wide)/9mm (thick)) drive equal to or exceeding the capacity of the current (bad) internal drive (~US$50-US$250, depending on size and stats - up to 320GB, e.g.)
    • (if possible) 1 new Powerbook G4 keyboard (~US$100)
    • (if possible) 1 new Powerbook G4 trackpad (~US$230)
    • How-Tos (either directly from Apple-supplied manuals or from the Intarweb). If Intarweb, do your best to pre-read and vet the things for sanity before relying on them. (free)
    • Specialized tools (I already have the torx drivers that the main sane looking how-to I’ve read recommends) (already have)
    • Other stuff your how-tos will tell you you need

Here’s the plan:

  1. Try booting, briefly, from the known-good external drive, just to be sure we’re okay there. Shut down as soon as possible after confirming, in case the issue is really a virus or something (unlikely, but risks must be managed).
  2. Take the new external drive and enclosure and try to use SuperDuper with the current (bad) internal hard drive still installed in the Powerbook to dupe the content from the bad drive to the new drive and enclosure. I say “try” because, like ClamXav, and depending on how good SuperDuper is at dealing with Hard Drive idiocy, it’s likely that this will fail before completing (this is not ideal, but expected and okay).
  3. Open up the Powerbook and remove the current (bad) internal drive. Stick it in the new empty external enclosure. (if I had another apple, I’d test it immediately)
  4. Install the new hard drive into the Powerbook. (it will be unformatted)
  5. Boot with the known-good backup of yore. (And here you want to be VERY careful that you’re formatting the right drive. Formatting the wrong drive could be a very bad idea here.) Boot with the Mac OS CD/DVD (because you can’t easily erase it). Format/initialize the new hard drive in the Powerbook using Disk Utility. Maybe use the “zero all data” option, also known as the non-quick format option (in PC-land) to flush out all the bits in the new drive and potentially flush out any bad clusters early.
  6. After formatting the new internal drive, boot with the known-good backup of yore and Super-Duper dupe the known-good backup back onto the new internal hard drive in the Powerbook. Shutdown. Disconnect known-good backup.
  7. Boot with the new internal drive with Super-Dupered content. Make sure it works. Maybe run ClamXav on it, maybe pay for MacScan and run that on it too.
  8. At this point you want to assume that the worst has happened to your older drives/more suspect data so…
  9. Definitely run ClamXav on the two external drives (the new external drive that you bought as a package, and the bad drive you slapped into the empty external enclosure - NOT the known-good drive, only touch that with anything that might change it when you are sure everything’s cool and you’re back on your feet). If those run okay (or fail at expected junctures) then recover as much data as you can and sock it back onto the new internal drive. After copying any data from these sources, run more ClamXav/MacScan on the internal drive.
  10. When satisfied that the data is recovered as much as possible, clean and safe, take a new SuperDuper backup to the drive that has data that matters least to you. I could argue for using either the known-good drive or the newer drive-and-enclosure. I think that we’ll probably use the newer one, because it’s more comforting to have a solid fall-back position than a sort of okay fallback position. Some folks even buy a third external enclosure and drive for this purpose. I could see doing that too.

At this point, the drive should be taken care of.

  1. Take the Powerbook apart again and replace the keyboard. Test it.
  2. Take the Powerbook apart again and replace the trackpad. Test it.

At this point? Done? Hopefully?

Tags:   · · · · · · · 3 Comments

You must log in to post a comment.

3 responses so far ↓

  • 1 ckd Jun 1, 2008 at 10:52 am

    Some comments:
    Since Mac OS X is Unix underneath, the equivalent to chkdsk is fsck. Disk Utility will also let you run a check, which AFAIK is basically just running fsck underneath.

    Step 5: if possible, don’t boot with the known-good backup at all. Boot with a Mac OS X CD/DVD, which you can’t accidentally erase! Connect the backup and boot from it after you’ve formatted the new drive. (If you look in the menu bar after booting from the CD, one of the options will let you run Disk Utility. I don’t remember exactly which one it is.)

    Also, when formatting the new drive, I generally use the “zero all data” option as a way to force each block to get written, in hopes of flushing out any bad sectors early.

    Then once that’s done, shut down and reboot off the backup to start the SuperDuper copy.

    Apart from that, I’d say you have the procedure nicely figured.

  • 2 Malcolm Jun 1, 2008 at 11:13 am

    @ckd:

    Thank you! We’ll look for that Mac OS X CD/DVD after we move. I’ll update the procedure here too to reflect this.

    Do you know if I can get replacement keyboard/trackpads for the Powerbook? I assume so, I just ain’t gone looking yet.

  • 3 Malcolm Jun 1, 2008 at 12:06 pm

    @ckd:
    Nevermind about the keyboard/trackpad question. I answered it already in the post.