This chapter is from the book
This chapter is from the book
This chapter is from the book
File System Management
The internal disk drive originally included with your Mac is probably the only new storage device you will ever come across that is already properly formatted for full Mac compatibility. Most new storage devices are either completely blank or formatted for Windows. For the most part, you will still be able to use Windows-formatted drives on the Mac without reformatting. Conversely, if you want to install the Mac operating system on a drive or you have a new drive that is completely blank, you will have to reformat the drive.
The primary storage management tool included with Mac OS X is /Applications/Utilities/Disk Utility. You may have already used this utility from the Mac OS X Install DVD to reformat the system drive before you installed the operating system. Here you are going to explore all the aspects of this tool for managing disk and flash drives.
)
Though disk-based and solid-state drives are technologically different storage mediums, Mac OS X treats the two similarly because they both provide dynamically writable storage. Optical media, on the other hand, is handled differently by the Mac because it’s sequentially written storage. Using optical media is covered in the “Using Optical Media” section later in this chapter.
)
Formatting or Reformatting a Drive
Despite all the choices Mac OS X gives you for configuring storage, actually formatting a drive is quite easy. In fact, if you attach an unformatted device, the Mac will automatically prompt you to open Disk Utility. On the other hand, if you have a drive that is already formatted and you want to change the partition scheme or the volume structure, you can just as easily reformat the drive using the same steps.
)
It is important to remember that reformatting a drive will destroy any formatting that is already there; essentially, a reformatted drive is losing its contents. The drive will not technically be erased—all the bits are still stored on the device. Reformatting will simply replace the previously populated volume structure with an empty volume structure. Truly erasing the contents of a drive is covered in the “Securely Erasing Files” section later in this chapter.
To format a drive:
- Make sure the drive you wish to format is currently attached to the computer, and then open /Applications/Utilities/Disk Utility.
- Select the drive you wish to format from the column on the left.
The size, manufacturer, and model number is usually the name of the drive. If a drive has any volumes, they will appear directly below and indented from the drive entry. If you want to reformat the entire drive, be sure to select the drive, not a volume.
- Click the Partition tab to the right. This is the only section in Disk Utility that will allow you to change both the partition scheme and the volume format.
- From the Volume Scheme pop-up menu, choose the number of partitions you want for this drive. You must choose at least one partition.
- Once you have selected the number of partitions you desire, click the Options button at the bottom of the partition diagram
to set the partition scheme.
A dialog appears allowing you to select an appropriate partition scheme.
- Select your partition scheme, and then click the OK button to return.
If you have chosen multiple partitions, you can adjust their sizes by clicking and dragging the line between partitions in the partition diagram. You can also specify a precise size by clicking in a partition area and then entering a specific size in the Size entry field to the right.
- Choose a name and volume format for each partition.
If you have only one partition, enter an appropriate name and choose the volume format from the Format pop-up menu. If you have chosen multiple partitions, select each partition from the partition dialog first and then set the name and volume structure.
- Once you have double-checked all your choices, click the Apply button.
You will be presented with a summary dialog, reminding you once again that continuing may destroy any previous volumes. If you are sure this is what you want to do, click the Partition button once more.
Partitioning and formatting takes only a few moments, and once the process is complete, you should see new volumes in the Disk Utility list and in the Finder.
)
)
)
)
)
)
)
Repartitioning a Drive
The previous system version, Mac OS X v10.5, introduced a new feature in Disk Utility that enables you to dynamically repartition a drive without destroying any currently stored data on the drive. This functionality was introduced primarily to facilitate the Boot Camp setup process.
The only downside to dynamic repartitioning is that some drives may not support the partition changes that you want to make. For instance, some drives may be too full for you to repartition. Also, Disk Utility does not support dynamically repartitioning drives formatted with the Master Boot Record partition scheme. If you come across any of these issues, you can resort to using the old method for repartitioning a drive, which does erase any previous formatting, as outlined in the prior section of this chapter.
To dynamically repartition a drive:
- Quit all open applications, as they may crash while the file system is being changed and consequently cause data corruption or loss.
- Make sure the drive you wish to change is currently attached to the computer, and then open /Applications/Utilities/Disk Utility.
- Select the drive you wish to change from the column on the left.
The size, manufacturer, and model number is usually the name of the drive. Do not select any of the drive’s volumes.
- Click the Partition tab to the right.
Any data currently on the drive will appear as a light blue area in the partition diagram. White areas indicate free space.
- Resize any volume, or add new volumes, or delete any volume that isn’t the current system drive.
- To resize a current volume, click and drag from the bottom-right corner until you reach the desired new size. You will not be allowed to shrink a volume past the light blue that represents data on the drive. You may choose to leave parts of the drive empty if you plan on formatting those parts later using another operating system.
- To add a new volume, click the small plus button below the partition diagram. Remember, you can have as many as 16 partitions per drive. Be sure to choose an appropriate name and volume format from the pop-up menu for each new volume.
- To delete a volume, select it from the partition diagram and click the minus button below the partition diagram. If you are deleting a preexisting partition, you will be presented with a verification dialog. If you are certain that you want to delete the selected partition, click the Remove button to finish the process. The volume will be deleted immediately, leaving free space where you will be able to resize other volumes or create new volumes.
- Once you have made all your changes and verified your selections, click the Apply button to continue.
- You will be presented with a summary dialog, listing what changes will be made and which (if any) volumes will be erased.
If you are sure this is what you want to do, click the Partition button once more.
Depending on how much preexisting data must be moved to create your new disk structure, it may take quite a while for the repartitioning process to complete. You should not attempt to interrupt Disk Utility or open any other applications while the system is repartitioning the drive. Doing so may result in catastrophic data loss.
- Once the process is complete, you should immediately notice the changes in the Disk Utility list and the Finder.
)
)
)
)
)
)
Erasing a Drive or Volume
You have seen earlier in this chapter how Disk Utility can be used to quickly erase an entire drive or volume by reformatting it. Yet the default reformatting process does not actually erase any files from the drive. This is because Disk Utility simply creates new blank volumes by only replacing the file and folder structure data of any volume. The old data files still remain on the drive and can be recovered using third-party recovery tools.
In fact, there is no such thing as erasing data from a drive—all you can do is write new data on top of the old data. Therefore, if you want to truly “erase” a drive or volume, you must somehow write new nonsensitive data on top of it. Disk Utility includes a variety of options that will let you securely erase old data. You can securely erase an entire drive or volume, or just a volume’s remaining free space.
To securely erase an entire drive or volume:
- Make sure the drive or volume you wish to securely erase is currently available to the computer, and then open /Applications/Utilities/Disk Utility.
- Select the drive or volume you wish to securely erase from the column on the left.
The size, manufacturer, and model number is usually the name of the drive. If a drive has any volumes, they will appear directly below and indented from the drive entry. If you want to reformat the entire drive, be sure to select the drive, not a volume.
- Click the Erase tab to the right, and then click the Security Options button.
You will be presented with a dialog allowing you to choose one of the four erase options. Select the radio button next to your preferred erase method and click the OK button to continue. The four erase options are:
-
Don’t Erase Data. This is the default action that occurs when you erase or reformat a drive or volume. Obviously, this does not provide any security from drive-recovery utilities. On the other hand, this choice provides a nearly instantaneous erase option.
-
Zero Out Deleted Files. This option will write zeros over all the data once. This is the quickest of the secure erase options, and for most users provides an adequate level of security.
-
7-Pass Erase. This is a very secure option that writes seven different passes of random and patterned information to the drive. According to Apple, this option even meets with U.S. Department of Defense standards for securely erasing data. The downside is that this method will take seven times longer than the standard zero-out method.
-
35-Pass Erase. This is the most secure option, which borders on paranoia. The Mac will write 35 different passes of random and patterned information to the drive. Obviously, this method will take 35 times longer than the standard zero-out method.
-
- At this point you can also change the volume’s name or volume format.
- Double-check all your choices and then click the Erase button.
- You will be presented with a summary dialog, reminding you once again that you will destroy data on any previous volumes.
If you are sure this is what you want to do, click the Erase button once more.
Depending on the size of the selected drive or volume and the erase option you chose, this process can take anywhere from seconds to days. If the process is going to take more than a few seconds, Disk Utility will show a progress indicator with the estimated time required to complete the erase task.
)
)
)
Securely Erasing Files
Because securely erasing an entire drive or volume can take quite a bit of time, you may find it’s much quicker to use a more subtle secure erase method. Also, you may not want to erase the entire contents of a volume or disk—you may just want to securely erase a few specific files or only the free space on your drive. Fortunately, Mac OS X provides targeted secure erase options from the Finder and Disk Utility.
Use Finder to Securely Erase Selected Items
To securely erase only select files and folders:
- In the Finder, move the items you wish to securely erase to the Trash folder.
There are several ways to accomplish this task: You can drag and drop the items into the trash; you can select the items and then choose File > Move to Trash; or you can select the items and use the Command-Delete keyboard shortcut.
- Choose Finder > Secure Empty Trash from the menu bar.
The Finder’s Secure Empty Trash feature is a secure erase method, which writes seven different passes of nonsensical information on top of the erased files. According to Apple, this feature even meets with U.S. Department of Defense standards for securely erasing data.
- You will be presented with a verification dialog. If you are certain you want to securely erase the items in the Trash forever,
click the Secure Empty Trash button to continue.
Depending on the number and size of the files to be erased, this process can take anywhere from seconds to days. The Finder will show you a progress indicator, but it will not show an estimated time.
)
)
Use Disk Utility to Securely Erase Free Space
If in the past users have neglected to securely erase their files, you can cover their tracks by erasing a volume’s free space. To securely erase a volume’s remaining free space, including any previously deleted files that were not securely erased:
- Make sure the volume with the free space you wish to securely erase is available to the system, and then open /Applications/Utilities/Disk Utility.
- Select the name of the volume with the free space you wish to securely erase from the column on the left. Do not select the drive.
- Click the Erase tab to the right, and then click the Erase Free Space button.
You will be presented with a dialog allowing you to choose one of the three available secure erase options similar to erasing an entire volume or disk: Zero Out Deleted Files, 7-Pass Erase, and 35-Pass Erase.
- Select the radio button next to your preferred erase method and click the Erase Free Space button to continue.
Depending on the amount of free space to erase and the erase option you chose, this process can take anywhere from seconds to days. If the process is going to take more than a few seconds, Disk Utility will show a progress indicator with the estimated time required to complete the erase task.
)
)
Mounting, Unmounting, and Ejecting
Mounting a volume is the process by which the system establishes a logical connection to a storage volume. This is not something users normally concern themselves with on the Mac, because the system will automatically mount any volume connected to the Mac. Simply plug a drive in and the drive’s volumes will automatically appear in the Finder and Disk Utility.
On the other hand, ensuring users properly unmount and eject volumes is very important to maintaining data integrity. Unmounting is the process of having the Mac cleanly disconnect from a drive’s volumes, whereas ejecting is the process of having the Mac additionally disconnect electronically from the actual hardware drive or media. When you choose to eject a drive from the Finder, the computer will actually unmount the volumes first and then eject the drive.
Ejecting Drives
There are three methods to unmount and eject a drive from the Finder:
- Pressing and holding the Eject key, the furthest top-right key on a Mac keyboard, for a few moments will only unmount and eject optical media.
- Select the volume you wish to unmount and eject from the Finder’s sidebar, and then choose File > Eject from the menu bar.
- In the Finder’s sidebar, click the small eject button next to the volume you wish to unmount and eject.
)
When you use the Finder to unmount and eject a single volume that is part of a drive with several mounted volumes, you will be presented with a warning dialog. You will be given the choice to unmount and eject all the volumes on the drive or just the volume you originally selected. You shouldn’t experience any problems with a drive by having some volumes mounted while others are unmounted. Just remember to properly unmount the remaining volumes before you disconnect the drive.
)
Manage Volume Mounts With Disk Utility
If you need to remount volumes on a connected drive, from the Finder you will have to unmount and eject the remaining volumes on the drive and then physically disconnect and reconnect the drive. Or, you can choose to manually mount, unmount, and eject items using Disk Utility.
To manually mount, unmount, and eject items:
- Open /Applications/Utilities/Disk Utility.
In this example screenshot, a variety of volumes are shown. Notice the volume names from the second drive appear in dimmed text; those volumes are physically connected to the Mac but not mounted to the file system.
- Select the volume or drive you wish to unmount or eject from the column on the left.
- If you have selected a volume to unmount, simply click the Unmount button in the toolbar.
The volume will unmount immediately, disappearing from the Finder, although in Disk Utility the volume’s name will remain but appear as dimmed text.
- To mount an unmounted volume on a connected drive, click on the volume’s dimmed name and then click the Mount button in the
toolbar.
The volume should immediately mount and appear in the Finder and as normal text in Disk Utility.
- If you have selected an entire disk to unmount all its volumes and eject, click the Eject button in the toolbar.
All the disk’s volumes will be unmounted, and then the disk will be disconnected from the system, disappearing from the Finder and Disk Utility. You will have to physically disconnect and reconnect the drive for its volumes to be remounted.
)
Ejecting In-Use Volumes
Any volume that contains files currently in use by an application or system process cannot be unmounted or ejected. The obvious reason for this is to avoid data corruption when a process attempts to write to files on that volume. If you attempt to eject a volume with in-use files, the Mac OS X v10.6 Finder will not allow you to eject the volume, but depending on the situation it will try to help you eject the volume. If the application or process using the volume belongs to your account, it will let you know via the following dialog. In this case the resolution is as simple as quitting the suspect application and attempting to eject the volume again.
)
If you don’t own the application or process using the volume, the Finder will ask if you want to attempt to forcibly eject the volume. To take this path you will have to click the Force Eject button twice, but the Finder will then try to kill the offending application or process to release the volume you’re attempting to eject. If the volume was successfully ejected, you will be notified by the dialog.
)
If this doesn’t work or the Finder doesn’t tell you which application is suspect, you can always log out the current user to quit all their processes and re-log in, or fully restart the Mac to clear the issue. While this may seem excessive, it is not advisable to physically disconnect a volume without first unmounting it, as covered in the next section.
If a volume still refuses to unmount after you’ve tried the previous troubleshooting steps, or you are unable to restart the computer, you can force a volume to unmount using the diskutil command. Again, it’s not advisable to force the system to unmount a volume, but if you need to unmount the volume, this method is better than physically disconnecting the drive from the Mac. The following command-line example shows how to forcibly unmount a volume named “ExternalDrive”; further, using this technique also requires administrator authentication:
MyMac:~ michelle$ sudo diskutil unmount force /Volumes/Backup
Improperly Unmounting or Ejecting
Disconnecting a volume from the Mac that you did not first unmount can lead to data corruption. If you forcibly eject a drive by physically disconnecting it before you unmount it, or if the system loses contact with the drive due to power failure, the Mac will warn you with a Device Removal dialog. You should immediately reconnect the device so the Mac can attempt to verify or repair its contents.
)
Any time you reconnect a drive that was improperly unmounted, the Mac will automatically run a file system diagnostic on the drive before it remounts any volumes. Depending on the format and size of the drive, it may take anywhere from a few seconds to several hours for the system to verify the contents of the drive. Again, journeyed volumes like JHFS+ should verify quite quickly. So if you connect a drive and notice there is a fair amount of drive activity but the volumes have not mounted yet, the system is probably running a diagnostic on the drive. You can verify that the system is diagnosing a volume by opening the /Applications/Utilities/Activity Monitor application and looking for a background process with fsck in its name. Monitoring processes is covered in Chapter 6, “Applications and Boot Camp.”