Backup Software and/or External Drives Failed Me Today - Best Future Options?

[RadDave]

Subject Concerns: Ransomware, Carbon Copy Cloner, Time Machine, & Recovery, for those interested and also to provide ADVICE for others in the forum who may be reading this post.

This afternoon, I was on Facebook (just have 8 friends nearly all family) and clicked a link to Lynda Carter (yesteryear's Wonder Woman) - now, I'm a movie and TV aficionado (and enjoy looking at beautiful young women) - WELL, w/i a blink of the eye, I was on a fake nude website that polluted my Safari app w/ the worst 'Ransomware' I've experienced - usually an easy out for me, but not this time despite stopping Wi-Fi, using several malware apps, rebooting, and trying to clear the Safari history for the day, nothing would work - mad as ****, I decided to just use my 'backup options' - no problem, right?

The computer in question is my 2013 MBPro which is B/U w/ CCC (Carbon Copy Cloner for those who may not know) x 2 & TM (Time Machine) x 2 - all backups made a week ago, thus nothing to really lose - SO, first step considered was to clone back (I have the MBPro & our iMac cloned on 2 external 1TB HDs partitioned in half - one is a WD & the other OWC) - the laptop's partition was not recognized when I tried to boot as the startup disc from the WD; then, the OWC partition started to clone and stopped w/ a big circle and a hash mark) - thus, two complete failures - what was the problem, the CCC software, the external HDs, or setting the latter up as partitions? YES - at the beginning (back in '13 & '14) I'd boot up the CCC clones to make sure they worked but got lazy.

Getting madder, I then decided to reboot to the recovery mode (CMD-R - BTW, how long does one need to hold down those keys on a startup?), and reinstalled Sierra from scratch; then did the same and plugged in on of my TM external HDs and after several hours, my MBPro rebooted fine and is working as expected.

Not sure how many will read this 'long winded' description of my experience this afternoon, but I NOW have a bunch of questions that might be addressed by our experienced 'gurus', and hopefully will help others in setting up their backup plans: 1) Cloning Software (several options) - should one always test a clone by booting the external drive after each BU - boy, a PITA; 2) TM Backups - this is a must! Recovery boots as in my experience today, allowed reinstatement of the macOS and then my recent TM files to be restored - for those wondering, DO IT!; 3) External HDs - virtually all of mine are still spinners running on USB power (have some Thunderbolts & one SSD) - which ones to choose - love SSDs but so expensive when getting into the 1+ TB range; and 4) When should these BU HDs be replaced - I've been part of many threads discussing the potential 'life span' of these spinners, typically start going down hill after 3-4 years - should I have replaced these 4+ year-old drives by now?

My immediate plan is to obtain a few new external HDs (likely from OWC) and make non-partioned CCClones of my iMac & MBPro; then I'll reformat the older HDs and make a second CCC clone of each. Really SORRY for the length of this post, but the topic seems important and ended up wasting my entire afternoon - I'm back up on my 'old' MBPro, so nothing lost (but my time) - in ending, all that I can say is a desire to line-up those A-Holes who create this malware and simply wipe then from the face of the earth! Dave
.

 

[Slydude]

Glad you are back up and running, In no small part thanks to a pretty good backup strategy on your part. You've taken a sort of "belt and suspenders" approach with the two backups. I am by no means a guru and others may disagree with my thoughts but here goes.

1. Testing the bootability of a clone is always a good idea. Like you I've used several programs to do clones. I've only had a clone fail once but it was quite a rude awakening to discover that when I really needed it I couldn't boot from the clone.

2. As far as the TM backups are concerned, once you boot from the recovery partition I believe it is possible to restore from the TM backup without reinstalling the OS first. This cuts out the step of reinstalling the OS. This of course assumes that you haven't excluded the system files from the TM backups. Perhaps someone can confirm this. IIRC Randy has also pointed out that Time Machine backups are now bootable thus reducing the need for a clone. I'll see if I can drag up that post.

3. I'll leave this for others to comment on.

4. As you've pointed out there seems to be a consensus that the life of a spinning hard drive is something on the order of three to five years though I haven't looked at this extensively. If thats the case a prudent gesture might be to replace one of the drives each year thus avoiding the cost of replacing everything at once. Large organizations use this policy routinely if I am not mistaken. If, for example, the average low quality mattress lasts five years, customers can expect to be replacing about 1/5th of the mattresses each year.

 

[RadDave]

Thanks Sly for the comments - a pain to boot every time from a 'new' clone (I have 3 computers and clone each one weekly; 2x on two, so 5 clones/week); will be curious if others respond about their 'clone booting' philosophy? I will also be curious about booting from a TM backup - yesterday, I first booted into recovery mode (CMD-R), then reinstalled Sierra - second, I rebooted again into recovery mode, selected the TM option, plugged in a HD, and waited several hours - all came back fine. Dave

 

[Slydude]

You clone things a bit more often than I do. Must be that "Be Prepared" motto kicking in. Do I sense Eagle Scout somewhere in your past?

Here's Apple's notation about booting from a Time Machine backup

• In OS X Lion v10.7.3 or later, you can also start up from your Time Machine disk, if necessary. Hold down the Option key as your Mac starts up. When you see the Startup Manager screen, choose “EFI Boot” as the startup disk.

See the Restore section of this document

P.S. Depending upon how closely the specs of the various Mac are and how xclosely the software installed on the two machines matches you may be able to use one clone to boot several machines. When I first bought the 2015 iMac I could use the El Capitan clone from my 2008 MB Pro to boot in an emergency. I wouldn't do that now because the MB Pro can't go past El Cap and the iMac obviously can.

 

[chscag]

I think I mentioned this before. I tested the EFI boot from my Time Machine backup and it does indeed work. However, I use CCC daily to two different external drives and make a TM backup weekly.

I now have 4 external hard drives sitting on my exec desk next to the iMac and keep one brand new drive in my computer closet just in case. Yes, I am a bit paranoid about backups. I don't have as many hats as that clever fellow from LA, so I have to be more prepared than an Eagle Scout. LOL.

 

[RadDave]

You clone things a bit more often than I do. Must be that "Be Prepared" motto kicking in. Do I sense Eagle Scout somewhere in your past?

Here's Apple's notation about booting from a Time Machine backup See the Restore section of this document

P.S. Depending upon how closely the specs of the various Mac are and how xclosely the software installed on the two machines matches you may be able to use one clone to boot several machines. When I first bought the 2015 iMac I could use the El Capitan clone from my 2008 MB Pro to boot in an emergency. I wouldn't do that now because the MB Pro can't go past El Cap and the iMac obviously can.

Thanks Sly for the additional information and links - was not aware of the boot options w/ a TM backup - does one need cloning software? Now another discussion that would be of interest to many - always easier to do fewer things!

For myself, I was a Cub Scout but never joined the Boy Scouts (we moved from Toledo into more rural southern Michigan when I was 12 y/o and lost interest, but made up for it in a LOT of other ways!) - but you're right - being retired and not using a computer for 'crucial' reasons, I probably could do less frequent backups - will consider - Dave

 

[Slydude]

I started using cloning software because TM wasn't bootable when it was first released. I hadn't realized it was now bootable till Randy mentioned it recently.

Even though TM backups are bootable I still keep clones around. The last time I had a drive failure I was back up and running in the time it takes to boot from a clone via USB, I could then restore any additional files from the TM backup. I could wait to copy everything back to the new drive when I had time. I'm not sure you can do things quite that way with a TM backup.

 

[chscag]

When you recover using Time Machine (EFI recovery) it installs macOS and then after which, you can restore your data using Time Machine. Kind of a convoluted way to recover but if you do not have anything else, it does work. Cloning software still works best in that situation. Of course if you have a dead hard drive - one that can not be accessed - you really have no other choice if you haven't used cloning software.

 

[RadDave]

Thanks Guys for your continued comments - as already stated in my OP, both of my CCC backups failed me - thus, I used macOS Recovery Mode (as shown below) - decided to reinstall Sierra first and then use the TM option, so took 2 boots - assume I got a 'clean' install of my files (free storage increased). I had a new 1 TB OWC HD which I made a new CCC clone of the MBPro; just ordered another one to do the same w/ our iMac (no more multiple partitions which may have not been the issue, don't know?).

Now I would still like to also have secondary CCC backups - my thought is to reformat the two older (i.e. 4 years) external HDs that I had partitioned and re-use - however, at that age, is this a good idea? Can these drives be tested (e.g. I have the utility DriveDx, but have not used it much)? Should one routinely have a 'replacement plan' for this process? Just adding more 'fodder' to this thread to provide information to those who may be visiting, reading, and wondering about these options. Dave
.

 

[pm-r]

Here's Apple's notation about booting from a Time Machine backup

Regardless of what Apple said as well as from a semi-respected VMUG member some years ago, a TM boot would NOT work for a client using Mountain Lion at the time, nor from another client sometime later who was using Mavericks or Yosemite, so I gave up ever trying and got then switched to using CCC. It worked. And after seeing even too many TM "backups" fail, I just couldn't recommend it. But maybe it works better now, but I sure won't be using it or suggesting one only use it for any reliable backup.





- Patrick
======

 

[pm-r]

as already stated in my OP, both of my CCC backups failed me

I'd sure like to know more details, as I'm sure Mike Bombich would also, as to some off the details, as I find it really hard to believe and assuming that the drives were in working state, that TWO CCC clones would fail. That's really quite hard to believe for my experience with it.

Were they both complete clones and did CCC indicate that they were bootable? Or was that even checked?

PS: I'm sure sorry to read about all your invasions and mishaps.




- Patrick
======

 

[RadDave]

I'd sure like to know more details, as I'm sure Mike Bombich would also, as to some off the details, as I find it really hard to believe and assuming that the drives were in working state, that TWO CCC clones would fail. That's really quite hard to believe for my experience with it.

Were they both complete clones and did CCC indicate that they were bootable? Or was that even checked?..........

Well Patrick, you obviously did not read my first posts carefully - I was not blaming any of many possibilities for these CCC to not work for me yesterday - for my MBPro, I had 2 CCC backups on 2 differently partitioned HDs - on the OWC drive, I tried the partition twice and both times about half way through, a circle w/ a hash appeared and the upload stopped? Now was this a software issue due to CCC and/or a HD problem related to the drive - I don't know, sorry.

Second, I tried my other CCC clone on a WD HD and the partition did not show up in my boot options in System Preferences, likely more a HD issue but I cannot say, and if the CCC partition did appear, would it have worked? Fortunately, I was able to recover, as described w/ TM. Will I continue to use CCC - YES, will just redo on some new HDs, will not use partitions, and test the older drives. Dave

 

[pm-r]

Well Patrick, you obviously did not read my first posts carefully -

Sorry Dave, but I did read it all carefully, in fact several times. I guess I'm just trying to figure out why or what actually all went wrong.

Also, I've nearly always used various partitions and multiple, various CCC clones and only had some trouble once that was surmountable.

Anyway, I'm glad to were able to get everything recovered and working.




- Patrick
======

 

[RadDave]

Sorry Dave, but I did read it all carefully, in fact several times. I guess I'm just trying to figure out why or what actually all went wrong.

Also, I've nearly always used various partitions and multiple, various CCC clones and only had some trouble once that was surmountable.

Anyway, I'm glad to were able to get everything recovered and working.

Thanks Patrick - the MBPro has been fine today; don't disagree at all in using multiple partitions on the same drive(s), just simpler in my mind to now use one partition (guess that I could buy LARGER HDs?) -

But for all, I did some further testing, have additional questions, and need to make some decisions - again, this just may help others coming to this thread w/ questions on backup issues. I had a recently purchased OWC 1 TB HD in the cabinet - did a 'new' CCC backup of my 'restored' MBPro (need to test w/ a boot); also, just ordered a similar HD which I'll use to do a new CCC clone of my iMac (just one partition).

Now, I'd like to also make second BU CCC clones of both computers using my older HDs which are now 4 years old - good idea or not?

Using the DriveDx App (see pic & check link, if interested), I checked both of these older HDs (results shown in the screen captures below) which look great! Also, ran 'Disk Utility' on both drives and no problems found - thus, my plan is to simply reformat each and put on my second CCC clones - does this make sense?

Just a final question relative to the last comment above - I think of external spinning HDs potentially 'dying' increasingly after 3-4 years - now these 4 year-olds that I own have been used only once a week or less - does 'limited use' of a HD equate to 'daily use' relative to longevity of the device - don't know, so would be interested in comments. Dave
.

 

[pm-r]

Now, I'd like to also make second BU CCC clones of both computers using my older HDs which are now 4 years old - good idea or not?

Why not, especially figuring you like having redundant backups and I sure don't know of anything wrong with that.

But I would do a zero-out (security wipe option) that would map out any possible bad sectors.

- does 'limited use' of a HD equate to 'daily use' relative to longevity of the device -

Good valid question Dave.

Regardless of a drive's MTBF rating, I've always understood that the power-on part of any electronics always takes the biggest toll and I don't really know how that relates.

But you've already covered your failure odds by having multiple backups — as long as they get TESTED TO WORK and are kept fairly current.

PS: SMART Status is just basically an educated estimate based on some various known functions or failures. And I've never had a hard drive that has failed give me any sort of SMART type warning, at least not with the normal software/utilities I have used.

All I do know is sooner or later they are NOT going to function properly if at all!!





- Patrick
======

 

[RadDave]

Why not, especially figuring you like having redundant backups and I sure don't know of anything wrong with that.
But I would do a zero-out (security wipe option) that would map out any possible bad sectors.

Good valid question Dave.

Regardless of a drive's MTBF rating, I've always understood that the power-on part of any electronics always takes the biggest toll and I don't really know how that relates.

But you've already covered your failure odds by having multiple backups — as long as they get TESTED TO WORK and are kept fairly current.

PS: SMART Status is just basically an educated estimate based on some various known functions or failures. And I've never had a hard drive that has failed give me any sort of SMART type warning, at least not with the normal software/utilities I have used.

All I do know is sooner or later they are NOT going to function properly if at all!!

Thanks Patrick for your comments above - I'll proceed as explained previously w/ redundant CCC clones and will test more often w/ a reboot from the cloned HDs.

Past few days, I've been looking for information on HD failure rates relative to use (i.e. constant vs. intermittent) - this recent ARTICLE quotes a lot of Backblaze data, and also suggests that how the HD is used makes little difference based on a Google study (see quote below), however, that study HERE is 10 years old (i.e. data still reliable vs. modern HDs?). Dave

Conventional wisdom would have you believe hard drives that get hot will generally fail faster than those that don’t. Some studies conclude as much, but the largest study on the subject matter to date performed by Google suggests otherwise. You might also assume that hard drives which are used more fail quicker than those used less. Not so, says Google:

“Contrary to previously reported results, we found very little correlation between failure rates and either elevated temperature or activity levels.”

 

[pm-r]

@RadDave

Thanks Patrick for your comments above - I'll proceed as explained previously … …
Past few days, I've been looking for information on HD failure rates relative to use

Does it really even matter Dave or are you just interested in gambling odds and facts and like spending your time on such things…???

We all know, or should by now, that ALL data storage drives are going to fail at some point and it's NOT a matter of IF.

And do test regularly any backup you do have, that they work properly.




- Patrick
======

 

[Rod]

Dave no disrespect here but it seems like your actions in the first instance were a bit excessive.
This ransomware you describe just exactly what form did it take?
I ask because I have occasionally come up agaisnt things like "your computer has been locked by the FBI" for visiting this site or even "All of your files are now locked, do not attempt to close your browser, etc etc. In all cases money was the demand. These examples were from some time ago and at the time they were pretty scary. The last one I received was about a year ago and since then I have been using a VPN and Ghostery full time. This one claimed to have encrypted all my files and demanded a bit coin payment to unlock them. It also warned me not to try to quit my browser.
So this is what I did;
Turned off my wifi.
Used Clean My Mac to remove my Firefox browser(this is why I don't use safari for general browsing). A complete removal of all files associated with the app was performed.
I then ran the auto clean script to ensure system cache and other trash was removed.
I restarted my MBP, downloaded a new version of Firefox, logged into Mozilla, reloaded my bookmarks, extensions and settings.
All good.
I did rum Malwarebytes as well with no results.
I too have a couple of CCC clones and a TM backup so although I was pretty confident I could recover I was sweating for while there. Especially when I found that I could not exit the Ransomware page initially.
The point is once I removed the internet connection I was able to quit the browser which was reassuring and everything else "seemed" ok.
I suppose what I'm saying is don't panic if you encounter this stuff. There is a lot of "Scareware" out there that mimics real Ransomware.




Sent from my iPhone using Mac Forums

 

[RadDave]

Dave no disrespect here but it seems like your actions in the first instance were a bit excessive.
This ransomware you describe just exactly what form did it take?
I ask because I have occasionally come up agaisnt things like "your computer has been locked by the FBI" for visiting this site or even "All of your files are now locked, do not attempt to close your browser, etc etc. In all cases money was the demand. These examples were from some time ago and at the time they were pretty scary. The last one I received was about a year ago and since then I have been using a VPN and Ghostery full time. This one claimed to have encrypted all my files and demanded a bit coin payment to unlock them. It also warned me not to try to quit my browser.
So this is what I did;
Turned off my wifi.
Used Clean My Mac to remove my Firefox browser(this is why I don't use safari for general browsing). A complete removal of all files associated with the app was performed.
I then ran the auto clean script to ensure system cache and other trash was removed.
I restarted my MBP, downloaded a new version of Firefox, logged into Mozilla, reloaded my bookmarks, extensions and settings.
All good.
I did rum Malwarebytes as well with no results.
I too have a couple of CCC clones and a TM backup so although I was pretty confident I could recover I was sweating for while there. Especially when I found that I could not exit the Ransomware page initially.
The point is once I removed the internet connection I was able to quit the browser which was reassuring and everything else "seemed" ok.
I suppose what I'm saying is don't panic if you encounter this stuff. There is a lot of "Scareware" out there that mimics real Ransomware.s

Hi Rod - well thanks for your concern but not teaching me much at all at this point - done and know most of what you have described - I made a decision to alter my HD, either by using cloned software which did not work as already explained, and then using the recovery options, again explained previously. This was vicious 'ransomware' (asking for $$ and offering a phone number) that did not respond to my previous solutions - doing what I did eliminated the issue w/o calling and paying - I'm happy w/ my results, which I do not feel need to be subject to apparent insults. Dave

 

[Rod]

Sorry you took it that way. Perhaps you did not read my first sentence, "Dave no disrespect here," which is why I asked what form did the Ransomware take. Eg. Did it actually lock your device or did it just say it had.
Also I would like you to understand that what I Post is not just for you but anyone who may read the thread.
You would not be the first person to take a "Sledgehammer" approach to what amounted to be a hoax.
It may be that you had no alternative or simply decided to take that approach which is entirely up to you.
I am not nor have I ever been accused of being a troll.
I am sitting at home with a compound fracture to my right collar bone trying to fill my time by being helpful to people.