10.15 kernel panic when logging in (A1502 MacBook Pro)

The SSD seems Ok although it does have 30 reallocated blocks and has had 210 TB written. The errors make me think the SSD has gotten into a weird state. I've seen this happen with some SSDs. The failure of the short SMART self-test can sometimes occur when running the test while booted to the SSD. However, the DriveDx report shows multiple unknown read errors.

I have been successful in resetting the SSD to factory defaults by utilizing the SSD's built-in hardware secure erase feature. This process requires using a Linux boot disk and the command line. I can provide instructions if you are interested, but I will need to see if I can find one of my older posts since it has been a few years since I had to perform this procedure and writing instructions is complicated since I try to cover all the bases assuming the user has no or very limited knowledge of the command line.

I would like to have you provide me another report with the DriveDx app, but this time I need you to use the command line to generate a report instead. The DriveDx GUI app tends to not properly display some values, but the command line report may show some of the other values. Plus the information shown for Attribute# 173 Wear Leveling Count seems a bit odd to me, so I would like to see it in a different format.

To run the report using the command line, begin by launching the Terminal app and start typing "sudo " making sure to have at least one space after the letter "oh". Then using the Finder, drag & drop the DriveDx app onto the open Terminal window so it will autofill the path to the DriveDx app. Press the Delete key to delete the space at the end of the path, then type the following to extend the path:

/Contents/Resources/smartctl  -a  /dev/disk0   |  tee  -a  ~/Desktop/SSD_report_2023-12-02.txt

Assuming the DriveDx app is in the Downloads folder the complete line should look something like this (keep in mind where you see my username "hwtech" you will see your own macOS user name instead):

sudo  /Users/hwtech/Downloads/DriveDx.app/Contents/Resources/smartctl  -a  /dev/disk0   |  tee  -a  ~/Desktop/SSD_report_2023-12-02.txt

The "sudo " part will prompt you for your admin password since the command needs root access to run the part of the DriveDx app which actually reads the health information on the drive. The part after the vertical line is a way of sending the output to a text file which I'm placing on your Desktop so you can copy & paste the contents here. The output will also scroll on the Terminal window as well. The " -a " part of the "tee" command is a flag so that if the file already exists, it will just append the new output to the end of the file....more of a safety feature for me since I hopefully offered a unique name for the file "SSD_report_2023-12-02.txt".

You will be prompted for your admin password. Nothing will appear on the screen as you type the password, so press the "Return" key to submit the password.

And let me know if you are interested in using a Linux boot disk to reset the SSD's hardware to factory defaults. If there is a hardware issue with the SSD, there is a slim chance that this reset could brick the SSD making it completely unusable. I have used this procedure on multiple Apple SSDs including the ones in the Retina model laptops.

Edit: I should clarify that the reset to factory default of the SSD would destroy all data, but may allow the SSD to be used once more.

I should add that a Linux boot disk may also be able to access the data, or has a better chance than macOS. However, you can try using the command line to mount the SSD as read only. Is the internal SSD using the HFS+ (aka MacOS Extended) or APFS file system? Please post the output of the following terminal command so I can be sure how to help you mount it read-only:

diskutil  list  internal

If the internal SSD is using the HFS+ file system, then it may be possible to try to repair it using a paid third party app Disk Warrior which tends to do wonders fixing corrupt HFS+ file systems, but if the SSD's hardware is having issues, then the DriveDx app may fail, plus I'm not sure if the current version of Disk Warrior will work on macOS 10.11.

It may also be possible to perform a low level bit for bit block clone of the SSD so that Disk Warrior can be run on the clone located on a good drive.

Or you can contact a professional data recovery service such as Drive Savers to try to recover the data. They provide free estimates and are recommended by Apple and other OEMs.

Thanks for providing the output from the command line version. It definitely makes the health attribute #173 much more clear:

ID# ATTRIBUTE_NAME VALUE WORST THRESH TYPE WHEN_FAILED RAW_VALUE

173 Wear_Leveling_Count 000 000 100 Old_age FAILING_NOW 27011478591696

This makes no sense since the "Value" and "Worst" should never be "000". Plus the "Raw Value" being 27 Trillion also seems odd, but it is possible it is not being interpreted correctly, or it verifies a glitch in the SSD. I'm leaning to a glitch which may be resolved by performing a hardware secure erase of the SSD using the SSD's built-in hardware secure erase feature which also resets the SSD to factory defaults, but it destroys all data on the SSD in the process. Good for trying to keep using the SSD, but not so good for your data.

Try to get your data off the SSD if possible. Your options are to use a professional data recovery service, or attempt to recover the data yourself.

To perform data recovery properly is not as simple as it seems since the first thing should be making a low level bit for bit (or block) clone using a special utility so that you can use the clone to attempt various things to try to fix the file system so you don't risk any damage to the original drive. Plus if the original SSD does have a severe hardware issue, it won't interfere with the data recovery process & you don't have to worry about the SSD failing completely. In fact, it is best to clone the clone so you can start over if any mistakes are made without ever needing to rely on the original SSD after the first clone. As you can see this gets complicated, time consuming, and even expensive very quickly.

Using the command line on a Linux system or boot disk is the best way to make a low level clone since macOS tends to interfere with the process and could cause more problems. However, once a clone is made, the recovery process will require using macOS to attempt to fix the file system of the clone or worst case having to rely on a data recovery app which may strip out file names & folder hierarchy.

Try booting into Safe Mode to see if that will allow you to log into the laptop. If it does, then it most likely means you have some third party software installed which is interfering with the normal operation of macOS. If Filevault is not enabled on your laptop, then it may be a login item....you can start by deleting login items in order to find the culprit.

If you can boot to an external drive, then it would seem to indicate the OS on the internal drive has an issue....most likely with third party software. If you have a third party internal SSD installed, then you will need to boot into at least macOS 10.13+ in order to see the third party SSD since older versions of macOS don't have the necessary NVMe driver to work with a third party NVMe based SSD.

Edit: Or maybe your third party internal SSD is bad or not compatible (or if using an SSD adapter, then the adapter may be incompatible (only the Sintech SSD adapter seems to be the most compatible with third party M.2 SSDs).

I thought you could run DriveDx from your external El Capitan boot drive you mentioned earlier. The health information available from an Apple SSD is very limited, but sometimes it may reveal a problem. Most SSD failures are more likely due to SSD controller issues which won't show up in any health report, but usually they will be accompanied by Kernel Panics which occur when waking the computer from sleep. Or the SSD will be missing when powering on the computer, but this is harder to tell since other things can be the cause of a blinking folder with a question mark.

As for Safe Mode, try using an external wired USB keyboard to see if that makes a difference. Maybe the built-in keyboard is having an issue so the key is not being properly recognized. I've seen this a few times where a key won't work before logging in, but will be fine once logged in (sometimes it may be the other way around too).

Third -party (non-Apple) software (eg: unnecessary virus-checkers, ad-blockers, cleaners and the like... even VPN or out-of-date apps / browsers) can often cause issues.

Try turning any such software off (or use uninstallers from their developers) and see if the issue remains or not.

Apple has a support page about kernel panic that might help you:

If your Mac restarts and a message appears - Apple Support

You can try starting up in safe mode and test if the issue still occurs, or not.

The process that occurs when using safe mode can also prove beneficial.

How to: Start up your Mac in safe mode - Apple Support

and

You can leave safe mode by restarting your Mac normally, and check whether the issue continues or not.

How to: Use safe mode on your Mac - Apple Support

If you have not been able to successfully log into macOS, then macOS may present a prompt to reset the password the next time you boot the Mac, but you can ignore the password reset and just click the "reboot" or "exit" button on the password reset screen. The next boot should not present you with the password reset screen. Apple is trying to be helpful assuming that the reason a person was unable to log in is because they forgot their password.

If you hold the Shift key too soon, then it can prevent some Macs from booting. If you don't hold the Shift key soon enough, then you miss the window of opportunity. It is best to hold the Shift key immediately after hearing the startup chime. If Filevault is enabled on the Mac, then you may need to hold the Shift key after submitting the login password. At some point in the boot process you should see "Safe Boot" in red letters in the top right corner (may appear in other corner(s) as well).

There is a chance it could be malware (there are no Mac virus), but a lot of semi-legitimate software is more likely causing the problem. Usual culprits are anti-virus apps, cleaning/optimizer apps, and third party security software....none of which are needed on a Mac and these types of apps usually causes more problems than they solve.

Lets check the health of the SSD by running DriveDx and posting the complete text report here using the "Additional Text" icon which looks like a piece of paper.

Do you have a good backup of the laptop before you encountered this issue?

When SSDs fail it is exceedingly rare to be able to recover anything, but it could be cabling or other problems.