iMac restarting unexpectedly

From the Limited knowledge of DriveDX and reading the report. I would be leaning towards holding off doing anything to drastic until a more Learned Colleague like @HWTech may pickup the question with much more insights specific to the DriveDC Report

External Drive is showing

Advanced SMART Status : OK

Overall Health Rating : AVERAGE 52.7%

Overall Performance Rating : AVERAGE 52.7%

Where as Internal Drive is showing

Overall Health Rating : GOOD 99.0%

SSD Lifetime Left Indicator : GOOD 99.0%

I would tend to say the External Drive is not really healthy

Q - More than one antivirus app:Have remove Avast and Malawarebytes

A - So what is being done about this issue

A - Any of these should be removed as per Developers Instructions.  Avast AntiVirus and read some of the posting and arrive at your own conclusion

Q - Does my CCC backup have to be bootable for me to restore data from it?

A - The answer is contained in this link Does my CCC backup have to be bootable for me to restore data from it?

Does my CCC backup have to be bootable for me to restore data from it?

No, in fact we no longer recommend that you attempt to make your backup bootable. Bootability is a convenience that allows you to continue working if your startup disk fails, but it is not required for restoring data from a CCC backup. You can restore individual folders and older versions of files (i.e. from snapshots) using CCC while booted from your production startup disk. CCC backups are also compatible with Migration Assistant, so you can use Migration Assistant to restore all of your data to a clean installation of macOS (e.g. on a replacement disk).

Related resources

• How to restore from your backup

All of the Kernel Panic reports and logs seem to be indicating a memory issue:

• element modified after free
• type 14=page fault (this is only useful if no patterns exist or when other memory related issues occur as it does here)
• malloc: Incorrect checksum for freed object 0x7fb61eea61c8: probably modified after being freed.

You can try seeing if the same thing happens while booted into Safe Mode which should disable the third party software from launching automatically during boot & login just in case some software is doing this, but I doubt it.

You can try running the Apple Diagnostics to see if any hardware issues are detected. You can also try using a bootable Memtest86 USB stick to perform a more thorough memory test. Besides the default configuration settings, if no errors are detected (and no system freeze when running Memtest86), then I would suggest changing the Memtest86 CPU setting to "Round Robin" and/or "Sequential" as I've had a couple of systems where these modes seem to cause system freezes on systems I already suspected had memory issues (or Logic Board issues). Once Memtest86 begins to run after booting you can safely disconnect the Memtest86 USB stick to help minimize it causing a problem during the tests. Unfortunately these tests are only useful if they fail a memory test or if the system freezes during the memory tests (once they start running).

Apple will only recognize a problem if the Apple Diagnostics report a failure, or the system gets these crashes after performing a clean install of macOS before installing any apps and before migrating/restoring from a backup. At least if Memtest86 reports a problem (or freezes), then at least you have a good idea what the problem may be (memory, or Logic Board is most likely).

The OWC SSD is a 3G model which indicates it only supports up to SATA II speeds which is only about 250MB/s max transfer rates. So the speed reported by EtreCheck is Ok.

The DriveDx report for the OWC SSD does show that the SSD currently has three Pending Blocks awaiting reallocation. It is possible if a macOS system file is located within those three bad blocks, that it could cause a problem. There has been a single "Offline Uncorrectable Block Count" which means at some time in the past there was an uncorrectable error. This may have occurred with the previous bad block that has already been reallocated which can sometimes happen if the bad block is not reallocated quickly enough if the block failure is severe enough. I doubt it is due to the current bad blocks awaiting reallocation since there is only a single uncorrectable error. I don't know when the SSD will trigger the reallocation of those bad blocks. In theory the SSD's controller should do this quickly (or at least when the SSD is not being actively used), but if it behaves like a hard drive, then the bad blocks won't be reallocated until data is written to those locations. I honestly don't know how/when this OWC SSD performs this operation.

There is also a single UDMA CRC Error which usually indicates an issue with the cable, but a single error is nothing to worry about and may have occurred with the SSD connected externally or to another system (perhaps even during manufacturer testing). There is no way to know without a former baseline report. This report will become the baseline for future checks.

FYI, it is perfectly normal for an SSD to encounter some bad blocks during its lifetime so this is not really a concern unless a lot of blocks go bad at the same time.

You may want to consider enabling TRIM on the SSD. While I know older versions of the OWC SSDs did not require TRIM, you are using a newer model of OWC SSD which utilizes a different controller, so it is hard to say whether they are the same. You can enable TRIM by using this Terminal command:

sudo  trimforce  enable

This will prompt you for your admin password. Nothing will appear on the screen while entering the password. Press the "Return" key to submit the password. You may also need to run Disk Utility First Aid on the "Macintosh HD" volume after the reboot so a TRIM command is performed immediately, otherwise it may take a while before macOS performs a TRIM operation.

Your external Hitachi hard drive has been running hot for a while (21K minutes), unfortunately we cannot tell when this occurred from the report. Highest temp was 67C while the highest average is 65C. The drives recommended max temp is 60C while the Max Limit is 70C. While the rest of the Hitachi's health attributes look Ok, there are some references to some errors outside of the attribute table such as some read recovery attempts, and a couple uncorrectable errors, as well as two "IDNF" error at 6,278 run time hours (mostly irrelevant now since the drive now has 17K hours -- drive may have been bumped)). I'm not certain how to interpret those couple items since I don't usually see reports with those errors (I usually only look at the main attribute table).

Except for the excessive heat I'm not sure there is any concern here. You may be able to retrieve a temperature history of the drive by using the Terminal command line to collect a temp history report using the core command line utility within the DriveDx app. Within the Terminal app begin by typing "sudo " (leave at least one space after the "o"), then drag & drop the DriveDx app onto the open Terminal window to auto-fill the correct path. Press the "Delete" key to remove the space at the end of the line, then continue typing the following:

/Contents/Resources/smartctl  -l  scttemp  /dev/diskX

You will need to replace "diskX" with the correct drive identifier for your Hitachi drive which you can retrieve using Disk Utility (or maybe even DriveDx). This drive identifier can change each time you re-connect the drive so you need to check immediately before issuing the command. In the DriveDx report the drive identifier was listed as "disk2". The final command will look something like this:

sudo  /Users/hwtech/Downloads/DriveDx.app/Contents/Resources/smartctl  -l  scttemp  /dev/diskX

The Kernel Panics were most likely caused by the Avast anti-virus software you had installed. Some of those Kernel Panics referenced memory that had been modified after release. That either means some third party software did this (anti-virus most likely), or some app has a bug, or you have bad memory.

EtreCheckPro version: 6.6.1 (66021)

Report generated: 2022-07-23 15:20:28

Problem: Computer is restarting

Major Issues:

Q -  Security updates disabled - Security updates are disabled. This computer is at risk of malware infection

A - Personal Preference but suggest enabling 

Q -  Kernel panics - This system has experienced kernel panics. This could be a sign of hardware failure.

Q - SSD too slow - SSD is showing poor performance.

Q -  disk0 - Mercury Electra 3G SSD 1.00 TB (Solid State - TRIM: No)  Internal SATA 3 Gigabit Serial ATA

A - Self Explanatory To evaluate the condition of the actual drive DriveDx There, I am not so good an interpreting the results

Q -  Apple security disabled - Apple security software is disabled. This computer is at risk of malware infection.

A - Personal Preference but suggest enabling 

Q - More than one antivirus app - This computer has multiple antivirus apps installed.

Q -  Antivirus software: Avast and Malwarebytes

A - There are no known Windows-like Viruses in the wild that self replicate and affect macOS, because of the underling UNIX  Foundation and Permission Limitation. 

Additionally, and specific to Big Sur macOS 11 and Monterey macOS 12, the Operating System resides in a Sealed and Read Only Volume that can not be opened by the User or “ Bad Actor “ Software.

The Only thing this Antivirus software is protecting is the Bank Account of the Developers and for zero return to the User aside from the problems this software creates.

AntiVirus Developers purposefully Market their product to create a “ Fear Factor “. In so doing, creating a False Need to for their Product.

The The Built in Security  is all that is required to protect the computer.

Q - No Time Machine backup - Time Machine backup not found.

A - 1/2  a Rescue Plan is in place . This becomes even more important especially if the Internal Drive is failing or about to fail

A - Do you have a Rescue Plan In-Place. This comprises having 3 Backups using 2 methods and 1 Off Site incase of Theft, Loss or Natural Disasters. A Time Machine Backup  is very useful and can be used to Revert to Previous Working macOS. 

For addition purposes - two Tested Clones each to separate external drives. This is insurance incase the upgrades goes sideways. At least one Tested Clone and / or Time Machine Backup should be Off - Site

Does my CCC backup have to be bootable for me to restore data from it?

Q - System modifications - There are a large number of system modifications running in the background.

A - Any time the computer is running with may modifications, some intentional and others not intentional, there are consequences which can be a contributor factor with the prime computer issue  

Q - Limited drive access - More information may be available with Full Drive Access.

A - Limited Disk Access will only give a partial Snap Shot of the Software installed on this computer

Hardware Information:  iMac (Retina 4K, 21.5-inch, 2017)

  iMac Model: iMac18,2

Q - System Software:  macOS Big Sur 11.6.5 (20G527) 

A - The current version of Big Sur, as of July 20, 2022 is now version 11.6.8

Q - [Running] Carbon Copy Cloner-2 (Bombich Software, Inc. - installed 2022-06-05)

A - Good and have been using this software for years. This would comprise the other 1/2 of the Rescue Plan outline earlier 

That is good the current recent temps are lower. I thought maybe if you could see when the high temps occurred it may give you a clue about what may have caused it. I do know the Hitachi drives do tend to run hotter than other brands, but Hitachi has been a good brand and has been my personal choice for years, although I am rethinking it now that WD has completely consumed Hitachi.

I have heard that the APFS file system is harder on hard drives than HFS+ so it could possibly make the drive work harder. The enclosure being used for the Hitachi drive may be the most critical as it may not have enough air flow for when you are working the drive hard.

As for the OWC SSD supporting TRIM, I am sure it does support TRIM (I recall another user posting that information after chatting with OWC tech support). I'm guessing the snippet you posted is from the Apple System Profiler or from Disk Utility. That information is showing that currently macOS does not have TRIM enabled for that SSD. If you enable TRIM, then you will see it change to "yes".

The hard drive has encountered a single bad sector which has been successfully reallocated. For the moment the drive is fine, but in my personal experience it usually won't be long before more bad blocks occur so make sure to have a good backup of the data on this drive.

FYI, the temperature on that UltraStar drive got over 60C (the recommended max temp) for 363 minutes. The maximum temperature allowed for this drive is 70C. The enclosure for this drive is not providing adequate cooling & air flow for this drive which runs hotter than most other hard drives.

Definitely appears this iMac has some bad memory, but the memory in this iMac is not easily accessible through external means and requires completely dismantling the iMac since the memory is located on the back side of the Logic Board which does not make it easy to troubleshoot even by an Apple Authorized Service Provider. There is always a chance the memory issue could be with the Logic Board instead.

Unfortunately all these tests do is help to identify and confirm a hardware issue. If the memory was easily replaceable, then the repeatable failure of these tests would help to identify the faulty component as each memory module is removed to identify the bad memory module. If the failure occurs with both modules installed by themselves and the failure occurs with either module in either memory slot, then it would point to some other hardware issue with the Logic Board or possibly the power supply. There is always a slim chance the memory test has a bug which causes a false failure notice or system freeze.

However, combined with the multiple Kernel Panics and system log entries all referring to memory issues, I think it is fairly safe to say you have confirmed a hardware issue here with Memtest86 freezing up during the tests. The next step would be to try to identify if one particular memory module can be identified as the cause of the problem, but this is not easy at all on this particular model since Apple decided to prevent easy access to the physical memory. Even an AASP will find this difficult.