Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

what are the extra 13 paritions? root user security concerns?

I [was] running Yosemite 10.10.3 on a Late 2014 iMac Fusion Drive SSD and HDD

This might be a bit confusing, and I need assistance from someone who really knows what they're talking about here.


When messing around trying to secure my system, I enabled the root user to view certain files, and accidentally did not disable it when I was finished. After this, I unknowingly ran my computer for probably a month as the administrator with the root user enabled, and made number of downloads in the process (which used the same password as root). After recently realizing this, I noticed in my activity monitor that some of my downloaded application were running as root user, not as administrator, as I thought they should be, and I also found malware after running ClamXav.


Because of all this and my compromised root, I wanted to ensure there was no third party code was deeply embedded in my drive, so I backed my important data, and actually proceeded to (very carefully) separate my fusion drive using 'diskutil' commands, wiping and reformatting everything but the base system. Then, I booted into safe mode to check the "diskutil cs list" and "diskutil list" through the terminal, and was surprised to still find 17 partitions in total, including those in my Logical Volume Group. Command "diskutil cs list" reveals partitions /dev/disk0 as my SSD, /dev/disk1 as my HDD with .efi and recovery, and /dev/disk2 as the apple base system, and ALSO /dev/disk3 as my HDD again (which is an unusual addition to what I have seen as typical LVG diskutil cs list outputs, though I assume it is just be related to booting from recovery mode with no OS on my disk any longer)


Command "diskutil list" reveals these disks (/dev/disk0-3), along with small partitions, dev/disk4, /dev/disk5....all the way up to /dev/disk16. All these unknown disk partitions 4-16 range from 0-4mb in size. One of my main questions is simply what all of these extra partitions are.... are they just required hidden partitions only visible through the recovery mode boot?


Even if so, is there a possibility that my actions explained in the first paragraph have compromised the integrity of ANY of the disks on my drive(s)? I do not want any installs to have access to my root, or to have embedded anything into my core system, regardless of whether they are malicious or not. I did not do a full zero secure wipe, as I figured that would be overkill and wear on my drives, but am also curious if it is even possible that the base system or other core components could have been injected with any 3rd part code. I know I may seem overly paranoid but I want to ensure that my system does not have any security holes from the start, before I go about re-installing all my software again, some of which opens up security holes, but I am required to have it for my work.


I want to note that I have already downloaded a new OS through internet recovery mode onto my reconfigured fusion drive, and do not see these extra partitions when I am logged in as a user, however they still appear in recovery mode, re-affirming my assumption that they are simply hidden partitions only seen through the recovery boot menu. I still have not loaded any of my data however, and regardless of whether or not the extra /dev/disk partitions I noticed are simply hidden apple boot partitions, any advice on whether I should zero-pass wipe any drives and reinstall the OS again to absolutely ensure there are not security holes after having my root user compromised would be greatly appreciated. I could even resort to a full dban and use a snow leapord install disc I still have, but do not want to put extra wear on my drive it there is no chance these core drives were compromised. Sorry for not posting a picture of my terminal output as well; I was unable to setup an ssh connection to do a screen shot from the recovery partition. And thank you ahead of time to anyone who takes the time to read this and give me any advice.

Posted on Apr 30, 2015 9:39 PM

Reply
24 replies

Apr 30, 2015 10:04 PM in response to PRiSTiQUE

I want to note that when I do reinstall all of my software, I plan to setup my less secure applications (such as pure data which requires the Xquartz server, applications that require full Javascript, and remote connections), to be run on a STANDARD user account, another STANDARD account for personal information such as email, online banking, etc, and have my administrator account simply for troubleshooting. I will be using filevault to encrypt my drive as well. I have been told these methods would be the most secure approach, especially if I add my boot-camp windows partition, but again, I just want to ensure that I am starting from a fresh, secure, system after everything that has happened before I go about re-installing all this insecure software.

Apr 30, 2015 11:46 PM in response to PRiSTiQUE

IMHO, there is never a good reason to run as root. It's easy to view information about all hidden files as an admin using the Terminal app.


What malware did ClamXav find? Any that were Osx or just Win (Windows only)?


It is not normal to have those small partitions, but I have no idea what might have caused them.


A normal boot drive should look like this:

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 999.3 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3


A Core Storage drive will have an extra entry for a logical partition that matches any encrypted partition.


I'm afraid I don't have any experience with a Fusion drive, so hopefully somebody who does can shed some light on what they have.

May 1, 2015 12:05 AM in response to MadMacs0

ClamXav listed is as "possible malware", and they were just folders buried in my library with a long string of digits. I just pulled my backup drive out and reformatted after finding them, but I am now trying to get to the root of this, no pun (originally) intended.


Any ideas how to permanently remove these partitions from my HDD? I have tried forcible ejecting them after finding one other person in a random unix thread who experienced this issue, and was able to use "hdiutil detach /dev/disk[#] -force", which unmounts them even though they are automatically mounted from startup, but they still reappear when I reboot my computer. I think I tried to reformat them using "distkutil secureErase" method as they are not attached to my LVG I believe, and I think that erased them and reformatted them, but I wasn't sure if that actually wrote over them with zeros or just reformatted them. Either way it leaves 16 hidden partitions on my HDD, and I am unsure how to convert those back into my regular HDD (because they are hidden partitions). Any help on how I could go about deleting these /dev/disk partitions and simply reformatting my HDD to a normal JHFS+ after securely writing over these partitions would be awesome. I would just use Carbon Copy Cloner and fully wipe my drive and fusion structure but its obviously too late for that now, and would just bring me right back to where I am. Thanks again for any extra advice...

May 1, 2015 9:18 AM in response to PRiSTiQUE

The three-account advice was good. To really finish the gold-plating you should also (a) use different passwords for each account and (b) make sure that the password for user2 never ends up in the keychain for user1, etc.


To be honest, anyone cautious enough to set their machine up this way is probably not going to be susceptible to the phishing and con-the-user-into-installing-malware methods that Macs are most susceptible to.


Enabling root is a bad idea, use an admin account and sudo when higher privileges are needed.


Meanwhile, to answer the rest of your question, partitions of 0-4MB could be suspicious, or they could, for example, just be disk images (.dmg files) that you have opened and mounted. You'll need to post the actual output from the 'diskutil list' command rather than your impressionistic prose description of it, which is TL;DR.


C.

May 1, 2015 3:42 PM in response to Eric Root

These are photo screen shots with the UUID's covered, showing the output of "diskutil cs list" and "diskutil list".


I need to note that I have since re-separated the fusion drive in and then did a secure erase 1 pass of zeros over the HDD thinking that would solve the problem after realizing that these were not apple boot components, but I checked the output of "diskutil cs list" and "diskutil list" again and they were all embedded in there just as before. In response to someone elses comments I have made multiple encrypted .dmg files, but I thought I have only made around 4 or 5 EVER, not all these other ones, and was unaware that they stay embedded in your drive as partitions even after reformatting it. I also see that part of disk one and part of disk three are still fused together as a LVG, which makes this even more confusing. I cannot understand how all these partitions ended up like this, I did not intentionally add a SINGLE partition to my drive, and never separated the fusion drive until just the other day when I noticed all these extra partitions that couldn't be deleted. I'm beginning to the think the only solution is to do a one pass DBAN over both the drives, and then, (hopefully) I will be able to re-attached them in a fusion drive (which I have been able to do once now), and use an old snow leopard install disk to upgrade back to my Yosemite. Is that my best bet, and are there any risks involved with even doing that? If anyone has any other recommendations on a a simpler, safer way to delete all this extra stuff, and just get myself back to the core components so I can re-fuse my fusion drive and download as fresh OS, I would be beyond grateful.



User uploaded fileUser uploaded file

May 1, 2015 7:15 PM in response to cdhw

THANK YOU. Any substantial help at this point is beyond appreciated!!!!!


This does look remarkably similar to what I'm experiencing, and I had previously wiped my drive, which had a copy of windows 8.1 boot-camped, and the zero-pass wipe was (unknowingly at the time) unsuccessful, and reinstalled a copy of OSX.


My only worry is that my earliest time machine backup is from AFTER I (thought) I fully deleted my drive, and re-installed the OS X. So I am worried that using his recommended method will only bring me back to the same place I am now, because it would most likely have saved these partition structures (I know CarbonCopyCloner would have), but maybe time machine won't. So I'm going to go ahead and give it a try.


I consider myself pretty tech savy, but the repair core storage method looks incredibly complicated, along with the fact that I would have to edit a lot of his instructions to fit my particular situation, and could not copy the directions exactly, because of slightly different information, and I know how easily I could brick my hard drives for good going that route.


So thank you very much for find this link, I do think this is the root of my issues. I have proceeded to start the second method, and am already running into some commands not working, but I will try and figure it out and post back here if I cannot.


THANK YOU again, so much.

May 1, 2015 7:37 PM in response to PRiSTiQUE

These instructions are almost the exact same thing I tried earlier, missing just one step before separating my fusion drive. His recommendations are to fuse back together my disk0s2 (which is my Apple_HFS HDD), and disk1s2 (my Apple_HFS SSD). But I am curious if a standard fusion drive also includes the OSX Base system? I realize it might not let me fuse together three different volumes and limit it at just two, but I feel like that would be a lot better than simply hoping my recovery install doesn't actually just revert me back to the same position I am in now, or worse if there is any issue with my time machine backup. Does anyone know if I would be able to fuse together the two volumes listed above, as well as the OSX Base System, which would be disk2s2 in my case? If so, this sounds like a lots safer method, as long as the base system is not somehow embedded with all the other disk partitions as well.

May 1, 2015 7:59 PM in response to PRiSTiQUE

Usually when there's a bunch of partitions like that, it means the disk is encrypted or fused in your case.

To put it simply, it's normal to see something like that.


Since fusion may have failed and you're on the path for recovery, this article is also good for rebuilding the fused partition.

http://hints.macworld.com/article.php?story=2014030311173257

May 1, 2015 8:14 PM in response to PRiSTiQUE

To make the question even simpler, does anyone know a command (or if its even possible) to fuse together my SSD , HDD, and then only the the Apple_HFS OS X Base System? My understanding is that when you fuse a drive, if you create a fuse using command "diskutil cs create disk0s1 disk2s2", for example, it only fuses those aspects of the drive, not everything in between as well.


So I know I could do


"diskutil cs create "Fusion" disk0s2 disk1s2" and re-fuse my SSD and HDD, but I would ideally like to simply add disk2s2 as well (but not the parition scheme and map in between), so I can have my OSX Base System included in the new coreStorage Fusion Drive

May 1, 2015 9:16 PM in response to PRiSTiQUE

followed the guide every step, and used my earliest time machine backup, and just as I suspected I am right back to square one, minus the compromised root files. But I still want to completely delete all of these extra partitions! All of these extra paritions are NOT part of my Logical Volume Group, and are not coreStorage parts. I simply want to delete /dev/disk4 up to /dev/disk16 ......... "diskutil secureErase 1 /dev/disk4" (for example), was what I had tried, but it only writes over the paritions (and not all of them, just most of them....oddly some of them refuse to mount despite showing up in diskutil list). I feel like this has to be such as simple command to delete these partitions.....

May 1, 2015 10:55 PM in response to PRiSTiQUE

Sorry I'm late, but looks like you got most of the information you needed.


Apple has told me that it is not possible to deal with petitions once Core Storage has been invoked. If you use distill cs revert to restore things to normal, then you should be able to use Disk Utility to reformat both drives back to a single partition to get rid of all those smaller ones. It wasn't clear to me whether you did that before re-creating the Fusion drive. Unfortunately, Apple has not applied the resources necessary to provide a fully capable Core Storage GUI to allow you to manage the mess you somehow have now.

what are the extra 13 paritions? root user security concerns?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.