Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Can't Boot After New HD + Time Machine Restore

So a couple days ago my 27" iMac running Snow Leopard started making some weird noises and stalling out. Annoyed, I talked for a couple hours with apple tech support which eventually lead me to run an Apple Hardware Test. This test returned the error

"Alert! Apple Hardware Test has detected an error.
4HDD/11/40000000 SATA(0,0)"

I scheduled an appointment at the Genius Bar, and they replaced the hard drive.

After that I got it home and did a System restore from my time machine backup. It finished fine, but when I restarted it got stuck on the grey apple screen with the spinning dial thing.

I called apple back and they had me do a couple things like repair disk, verify disk, and one person had me reboot into this command line mode and type some stuff in. Nothing worked. After that They had me try to reinstall the OS first from archive, and next by erasing the hard drive and doing it. Both times the install fails with a big yellow exclamation point saying that it couldn't install support files and the OS couldn't be installed.

Any ideas how to fix this?

I'm currently trying to restore from my time machine backup again, but I'm not hopeful.

N/A, Mac OS X (10.6.6), 27" Core i7 iMac

Posted on Jan 30, 2011 3:42 PM

Reply
16 replies

Jan 30, 2011 4:50 PM in response to crummer

crummer wrote:
. . .
Both times the install fails with a big yellow exclamation point saying that it couldn't install support files and the OS couldn't be installed.


Let me be sure I understand; you erase the internal HD, try to install OSX from your Snow Leopard Install disc, then get this error?

If so, there's either a problem with the new disk, or your Install disc.

Clean it first. Use warm water and a small dab of dish soap or shampoo, rinse it clean and dry with a soft cloth. Do not wipe in a circular manner.

Try it one more time, but instead of just a "quick erase" of the internal HD, select +Security Options,+ then +Zero Out Disk+ as shown in #1 of [Formatting, Partitioning, Verifying, and Repairing Disks|http://web.me.com/pondini/AppleTips/DU.html] (or use the link in *User Tips* at the top of this forum). As noted, that will take a while, but let's be sure.

Then reformat it, also as shown (you probably only want a single partition).

Then quit Disk Utility and try installing OSX again. If you get the same message again, the disc is likely damaged.

If it's the one that came with your Mac, contact AppleCare. If it's a retail version, your Apple Store will probably replace it free, but at worst charge you $29.

Feb 14, 2011 8:57 AM in response to crummer

I'm in the middle of the same thing. To get more information, I've booted the machine into target mode ( hold "T" at startup ) then hit the disc from another Mac.

My /var/system.log is mostly filled with errors from various launchd crashes. All revolve around " CSSMOID_APPLE_TP_MACAPPSTORERECEIPT" (blued and others crash from this). After disabling most of the other items giving errors, the most likely culprit for not getting a login screen is:

Feb 12 03:47:12 [redacted] com.apple.loginwindow[4332]: dyld: Symbol not found: CSSMOID_APPLE_TP_MACAPPSTORERECEIPT
Feb 12 03:47:12 [redacted] com.apple.loginwindow[4332]: Referenced from: /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Frameworks/C ommerceCore.framework/Versions/A/CommerceCore
Feb 12 03:47:12 [redacted] com.apple.loginwindow[4332]: Expected in: /System/Library/Frameworks/Security.framework/Versions/A/Security
Feb 12 03:47:12 [redacted] com.apple.loginwindow[4332]: in /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Frameworks/C ommerceCore.framework/Versions/A/CommerceCore

I'm betting Apple released their 10.6.6 without testing if their new App Store "CommerceCore" framework restores properly from Time Machine.

I'm going to try to restore from my last backup just prior to patching to 10.6.6 - I'll let you know what I find.

Feb 14, 2011 9:02 AM in response to crummer

After further searches on that symbol, I just found the following thread, going over some of the work on this:

http://discussions.apple.com/thread.jspa?threadID=2740183&tstart=135

Boo apple. First you no longer support Time Machine with an Airport Extreme with Snow Leopard, then you release a Snow Leopard store framework update that you can't restore from backup to. What are you thinking?

Feb 14, 2011 9:35 AM in response to jasiakman

jasiakman wrote:
. . .
Boo apple. First you no longer support Time Machine with an Airport Extreme with Snow Leopard,


That's never been supported, probably because it's unreliable.

then you release a Snow Leopard store framework update that you can't restore from backup to.


Whatever the problem there is, it's not widespread. Many folks have restored form 10.6.6 without a problem. There must be something unique to the situation of the few folks that's happened to.

Feb 14, 2011 10:29 AM in response to Pondini

Pondini wrote:
That's never been supported, probably because it's unreliable.


Shame on me for bringing up an altogether different issue - rest assured this restore came from a USB-only mounted disk. However, the pitch I received at the Apple Store when I bought my AE for home (back in 10.3 or 10.4) was "that I could just hook up a hard drive and do Time Machine over the network." Hard to know that what Apple Store employees were pitching was "unsupported." (That, and Apple went out of their way to disable dumps to other disks, while Time Machine would specifically show an Airport Extreme disk as a valid target, but still, a digression.)


Whatever the problem there is, it's not widespread. Many folks have restored form 10.6.6 without a problem. There must be something unique to the situation of the few folks that's happened to.


I would disagree - google "CommerceCore Snow Leopard". See what comes up. The CommerceCore private framework (/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Frameworks/ CommerceCore.framework/Versions/A/CommerceCore) was just added in 10.6.6 - I verified. Given that it was only released a month ago, how many people have lost disks and done a time machine restore? Not many I'd suspect.

I'm running symbol dumps against various versions of /System/Library/Frameworks/Security.framework/Versions/A/Security - to see what, if any, symbol modifications occur, and poking the logs of a few other 10.6.6 machines to see what's up. My guess is either:

1) that the CommerceCore either loads something when it's installed, but the replication is not checked every reboot - sort of like failing to regenerate ssh keys

-or-

2) Time Machine is not thorough about certain symbol changes to libraries. This seems extremely unlikely.

Since quite a few people (50-100) rely on Time Machine quite heavily for backups around me, I've been tasked with digging into this further. I'll keep any further data I find going.

Feb 14, 2011 10:40 AM in response to jasiakman

jasiakman wrote:
. . .
Given that it was only released a month ago, how many people have lost disks and done a time machine restore? Not many I'd suspect.


Apple does their own testing, and plenty of users did beta testing before the release.

Since quite a few people (50-100) rely on Time Machine quite heavily for backups around me, I've been tasked with digging into this further. I'll keep any further data I find going.


Good. If/when you find something, post it here and see [Reporting a Problem to Apple|http://web.me.com/pondini/AppleTips/BugReport.html].

Feb 14, 2011 12:19 PM in response to Pondini

Pondini wrote:
jasiakman wrote:
. . .
Given that it was only released a month ago, how many people have lost disks and done a time machine restore? Not many I'd suspect.

Apple does their own testing, and plenty of users did beta testing before the release.


Umm... not sure what you're trying to say. Of course they test - in a former life I was a QA engineer. And of course, I've seen them miss plenty of things before - that's why I'm here. <grin>

Since quite a few people (50-100) rely on Time Machine quite heavily for backups around me, I've been tasked with digging into this further. I'll keep any further data I find going.


Good. If/when you find something, post it here and see [Reporting a Problem to Apple| http://web.me.com/pondini/AppleTips/BugReport.html ].


Here's what I've got - I grabbed symbol dumps from both a current up version of 10.6.6, and mine.

10.6.6, working - ran:
<pre>
nm /System/Library/Frameworks/Security.framework/Versions/A/Security | sed -e 's/^\[0-9\].* //' | sed -e 's/^[ ].* //' | sort > /tmp/SecSymbolDump1.txt
</pre>

10.6.6 restored hard drive - ran:
<pre>
nm /Volumes/Macintosh HD/System/Library/Frameworks/Security.framework/Versions/A/Security | sed -e 's/^\[0-9\].* //' | sed -e 's/^[ ].* //' | sort > /tmp/SecSymbolDump2.txt
</pre>

(in short, dumped out the symbol tables of both Security framework libraries, stripped out addresses and leading spaces, and sorted the entries).

Running a diff of these two produced the following
On the "new" 10.6.6 update:
APPLE_TP_MACAPPSTORERECEIPT
CSSMOID_APPLE_EXTENSION_MACAPPSTORERECEIPT
CSSMOID_APPLE_TP_MACAPPSTORERECEIPT
CSSMOID_MACAPPSTORE_CERTPOLICY
CSSMOID_MACAPPSTORE_RECEIPT_CERTPOLICY
_Z30certificatePoliciesContainsOIDPK15CE_CertPoliciesPK9cssmdata
_ZL33OID_APPLE_CERT_POLICYMACAPPSTORE
_ZL39OID_APPLE_EXTENSION_MACAPPSTORERECEIPT
_ZL41OID_APPLE_CERT_POLICY_MACAPPSTORERECEIPT
__ZN8Security12KeychainCore5Trust8evaluateEb
_isRevocationServerMetaError
randomfd.22458

On my machine:
__ZN8Security12KeychainCore5Trust8evaluateEv
randomfd.22457

The "new" 10.6.6 machine has the missing symbols, while the old machine does not. Also, the old machine has a slightly different version of the keystore trust library, and is apparently one rev older (22457 vs 22458).

I'm trying to dump the symbol table of a 10.6.5 Security library now - unfortunately, they don't seem to include nm(??) on the machine I'm looking at.

I'll also just try copying the updated 10.6.6 library over my old one - the only reason I haven't yet is that I'll lose any more testing data if it does work. I'd rather try to grab the value of randomfd out of a 10.6.5 Security library before I do that (any takers out there? Anyone with a 10.6.5 symbol dumper before I boot one into target mode and check it out?)

Feb 14, 2011 12:31 PM in response to jasiakman

jasiakman wrote:
. . .
Umm... not sure what you're trying to say. Of course they test - in a former life I was a QA engineer. And of course, I've seen them miss plenty of things before - that's why I'm here. <grin>


I'm saying this is not a general or widespread problem. Lots of folks have restored from 10.6.6 backups, including several I've helped in these forums, in the 6 weeks since it was released.

There's something unique to some setups, combinations of 3rd-party apps, kernel extensions, etc.

Feb 14, 2011 12:42 PM in response to jasiakman

jasiakman wrote:
Running a diff of these two produced the following
On the "new" 10.6.6 update:
[ snip ]
randomfd.22458

On my machine:
[ snip ]
randomfd.22457


Bingo ( sort of ). Running against a 10.6.5 version of the security library shows:

<pre>
Test1066 1065libcopy admin$ nm Security | grep random_fd
00000000002ab390 d randomfd.22457
</pre>

This doesn't mean that I've eliminated the cause - either the 10.6.6 update didn't update the Security library on my machine (and a few others), or Time Machine didn't track that the library changed. Neither makes much sense: if my machine didn't update the library, I'd expect it to have crashed the first time I rebooted . If Time Machine didn't grab the change, then I'm extremely confused as to it's algorithm for how it tracks changes.

I'll be back with a test copy of the 22458 library onto my machine and/or an analysis of the contents of Time Machine.

Feb 14, 2011 2:03 PM in response to crummer

Here's what I got - apologies for any formatting peculiarities.


The problem: 10.6.6 mac won't boot after time machine restore to disk.


Further symptoms: Booting with Command-v shows several errors: usually blued and loginwindow collapse with errors from launchd. Errors will be of the style "dyld: Symbol not found: CSSMOID_APPLE_TP_MACAPPSTORERECEIPT" and other CommerceKit / CommerceCore framework errors.


A solution: Your Framework Security library may be an older version (possible cause with Time Machine below). The easiest way to fix this is to find another, working 10.6.6 Mac, and update the Security library on the broken machine.


Identifying if you're affected:
1) Boot the broken machine into "target" mode - hold "Command-t" during boot until the [Firewire|http://itunesu.utah.edu/terms/images/Firewire_Icon.png] icon appears.
2) Connect the broken machine to the working 10.6.6 machine with a firewire cable.
3) On the working machine, the disk of the broken machine should mount.
4) Open Terminal
5) Run "ls /Volumes" - the name of disk you mounted should be there (in this example, we'll use "Macintosh HD".)
6) Typing in the path of the broken machine, run:
<pre>
nm /Volumes/Macintosh HD/System/Library/Frameworks/Security.framework/Versions/A/Security | grep random_fd | cut -d. -f2
</pre>


(this does a dump of the library, looking for the version value)


If this comes back with the value 22457 (or less?), your Mac is not booting because it does not have the updated version of the Security library, which is required in 10.6.6 since Snow Leopard added the Appstore / Commerce framework.


Fixing if you're affected:
1) First, make sure the working 10.6.6 Mac has a correct version of the framework:
<pre>
nm /System/Library/Frameworks/Security.framework/Versions/A/Security | grep random_fd | cut -d. -f2
</pre>


For 10.6.6, this should be at least "22458"


2) *Be extremely careful at this point* - Make sure on the mounted disk (not the machine you are working on!) run the following
<pre></pre>
2a) Make a backup of the broken library
<pre>
mkdir /Volumes/Macintosh HD/savedLibrary
cp /Volumes/Macintosh HD/System/Library/Frameworks/Security.framework/Versions/A/Security /Volumes/Macintosh HD/savedLibrary
</pre>

2b) Copy the working version over the non-working version:
<pre>
cp /System/Library/Frameworks/Security.framework/Versions/A/Security /Volumes/Macintosh HD/System/Library/Frameworks/Security.framework/Versions/A/Security
</pre>


3) Eject the mounted disk from the working Mac, disconnect the firewire cable, and reboot the "broken" Mac. It should come up.


If it doesn't, you have problem(s) that are probably outside the scope of this. I'd also suggest restoring your original security library that you saved off.


Suspected cause:
It appears that Time Machine never recorded the change to the Security library after the update. If the library hadn't changed, the machine should have failed to boot like it did after restore the moment a 10.6.6 update was applied.


Inspecting the contents of my Time Machine backups before and after updating shows that Time Machine never updated the Security Framework library - why is still not 100% determined, but restoring from it is definitely broken. Combing through the backup databases on my Time Machine disk:


(I upgraded to 10.6.6 on January 6)
<pre>
for name in 2010-12-30-093337 2011*
do
echo -n "In backup on ${name}, version of Security library is: "
nm "${name}/Macintosh HD/System/Library/Frameworks/Security.framework/Versions/A/Security" | grep random_fd | cut -d. -f2
done
</pre>


In backup on 2010-12-30-093337, version of Security library is: 22457
In backup on 2011-01-04-100707, version of Security library is: 22457
In backup on 2011-01-05-082402, version of Security library is: 22457
In backup on 2011-01-06-092846, version of Security library is: 22457
In backup on 2011-01-07-094827, version of Security library is: 22457
In backup on 2011-01-10-093559, version of Security library is: 22457
In backup on 2011-01-11-110542, version of Security library is: 22457
In backup on 2011-01-12-094137, version of Security library is: 22457
In backup on 2011-01-13-103238, version of Security library is: 22457
In backup on 2011-01-14-113145, version of Security library is: 22457
In backup on 2011-01-18-112856, version of Security library is: 22457
In backup on 2011-01-20-114953, version of Security library is: 22457
In backup on 2011-01-21-103642, version of Security library is: 22457
In backup on 2011-01-24-102321, version of Security library is: 22457
In backup on 2011-01-27-002508, version of Security library is: 22457
In backup on 2011-01-27-011931, version of Security library is: 22457
In backup on 2011-01-27-104406, version of Security library is: 22457
In backup on 2011-01-27-114322, version of Security library is: 22457
In backup on 2011-01-27-123928, version of Security library is: 22457
In backup on 2011-01-27-134523, version of Security library is: 22457

Feb 14, 2011 2:30 PM in response to jasiakman

One update:

jasiakman wrote:
5) Run "ls /Volumes" - the name of disk you mounted should be there (in this example, we'll use "Macintosh HD".)
6) Typing in the path of the broken machine, run:
<pre>
nm /Volumes/Macintosh HD/System/Library/Frameworks/Security.framework/Versions/A/Security | grep random_fd | cut -d. -f2
</pre>


For step #5 - it's better to run an "ls -l" on the /Volumes drive. Depending on what your hard drive is named, "Macintosh HD" may be a simlink back to your own machine:

<pre>
ls -al /Volumes
lrwxr-xr-x 1 root admin 1 Feb 14 13:53 Macintosh HD -> /
</pre>

These steps won't work if you use the name "Macintosh HD" and it just points back to your own drive (it won't do anything).

So, make sure you use the appropriate name of whatever the bad/target mac is in your path name.

Feb 15, 2011 9:41 AM in response to Pondini

Pondini wrote:


I'm saying this is not a general or widespread problem. Lots of folks have restored from 10.6.6 backups, including several I've helped in these forums, in the 6 weeks since it was released.


Update - I just had someone run a similar scan/symbol dump against their 10.6.6 machine and their time machine backup - the MBP has the updated security library on the box, but has not saved an updated version of the security library to time machine.

Looking at your web.me page, you seem to have some insight into time machine. Is there a flag of some type we can look for on the machine with the disparity as to why it's not being marked for update?

I'm examining 1-2 other systems here for scale, time permitting. I'll go ahead and file a bug report at the address you mentioned, but if someone on the back end of Apple wants some live test data, we seem to have a pretty good test-bed here for the problem, and a pretty standard machine setup.

Feb 15, 2011 10:04 AM in response to jasiakman

jasiakman wrote:
. . .
Is there a flag of some type we can look for on the machine with the disparity as to why it's not being marked for update?


#11 in [Time Machine - Frequently Asked Questions|http://web.me.com/pondini/Time_Machine/FAQ.html] lists the things excluded automatically, but the items you're talking about are not involved.

There is a long-known bug in Snow Leopard that, in a few cases, prevents either anything on the OSX drive, or anything in the /Users folder, from being backed-up. It's triggered by doing a +Verify Disk+ on the boot volume while running from it, or altering other partitions on the boot drive while running from it. But a Restart fixes it. See the yellow box in #D5 in [Time Machine - Troubleshooting|http://web.me.com/pondini/Time_Machine/Troubleshooting.html] (or use the link in *User Tips* at the top of this forum).

And, as mentioned in #D5, there are rare occasions where a folder, often a home folder, will be damaged somehow, and either backed-up in full on each backup, or not at all. So far as I know, nobody has figured out what's wrong, much less how to fix it. The only cure is to rename it, create a new one, and copy all the contents. If it's a home folder, of course, you have to create a new account and copy all the contents.

Mar 2, 2011 3:18 PM in response to jasiakman

sorry didnt help here.

on my mbp (which wont boot since i installed new system and migrated user from my TM backup)
i had value 22460 (after a wipe and clean install and usermigration 10.6.6.)

on my mac pro, which is fine, i had value 22458

i did, how you instructed, the mbp still wont boot, and my mac pro wont boot now, too.
the first time, the second it booted... 🙂

thanks

Mar 3, 2011 2:08 AM in response to peppermint

my tricky trick workaround for not booting macs after restore from TM backup:

last night i installed 10.6 over both nonbooting macs (non-booting after applying terminal text-lines above) and did software updates via "software update" panel.
after that i did some steps which wont be of need, in order to get a booting mac again, but i just insisted on, as precaution: reset PMU and P-RAM on both mac pro and mbp and repaired permissions with disc warrior 4.2 with booting mbp from mac pro and mac pro from mbp via target mode and firewire 800.

both macs are booting now and happy being released from hospital in the early morning.

🙂

Can't Boot After New HD + Time Machine Restore

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.