Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the TidBITS Content Network for Apple consultants.

An Apple a Day Keeps Norton Away

Last week, problem reports began circulating about troubles with Norton Disk Doctor (NDD) and newer Macintosh models, particularly new Power Macs. Symptoms include NDD reporting errors with disk directory information and allocation block sizes. If a user tells NDD to fix these problems, the program may crash toward the end of the repair, rendering the disk unable to boot and apparently losing all data.

The problem, although potentially serious, is easy to detect and, if you've already been hit, you may be able to recover your data.

Defining the Problem -- There are actually two problems: the first resides on the hard disks themselves, and the second lies with the way NDD reacts to those hard disks.

The root cause is extraneous "ghost" directory information on some hard disks that Apple has been shipping in newer Macintosh models. The precise origin of the spurious data is unclear, and "informed" sources have pointed to a number of possible causes. Some claim the disks were delivered to Apple with this problem; others indicate there may have been a subtle error with Apple's preparation of these drives in manufacturing; still other sources point to a combination of these factors. The problem only appears on internal hard disks, and does not appear on or spread to additional storage devices connected to these machines.

NDD is correct in identifying a problem. However, NDD's attempts to fix the problem often result in the disk being unusable and (apparently) wiped of its data. In reality, the data on the drive is intact and untouched; however, the directory information that enables the Macintosh to locate and retrieve that data is damaged.

Who's Affected -- The bottom line: people who have purchased any Power Macintosh computer since 01-Jul-95 should be concerned.

So far as I can determine, a description of the problem first appeared in E-News, a newsletter from Apples B.C. Computer Society, a long-standing Apple user group in British Columbia.

ftp://mirror.aol.com//pub/info-mac/per/apples- bc-e-news-95-09.hqx

This article gave a range of machines and serial numbers impacted. So far as I can determine, the article is at best only partly accurate. As of this writing, sources inside Symantec and Apple have reliably confirmed that the problem has been detected in the Power Macintosh 5200-series, 6100s, 6200s, 7100s, 7200s, and 7500s, all purchased since 01-Jul-95. Additionally, the problem has been reported in 6100-series Performas, Power Mac 8500s, and even a Quadra 630 (although I find this last hard to believe due to the drastic differences in the drive architecture of the machines).

What to Do -- First, don't panic. If you have a machine with this problem, it's unlikely to rise up and bite you in the next ten minutes.

Symantec has just released a free utility called Disk Spot Check that can both detect the problem and eliminate the residual "ghost" data if the user so chooses. It should be available via Symantec's FTP site but that site has been having intermittent problems. In the meantime, Ric Ford has kindly reposted Symantec's utility and information on the problem at his MacInTouch Web site (thanks, Ric!), and the program is also available in Symantec's AOL and CompuServe forums. It will be available on the Info-Mac Archives soon. The Disk Spot Check utility only needs to be run once; from that point onward, it's safe to use Norton Disk Doctor on the disk to attempt to repair any existing or future problems.

ftp://ftp.symantec.com//public/mac/num/ NUMSpot.Bin
ftp://mirror.aol.com//pub/info-mac/disk/norton -disk-spot-check.hqx

The second, more thorough option is to back up all your data, then perform a low-level format of your disk. Booting from another disk and choosing Erase Disk from the Special menu or deleting all the files is not sufficient. Similarly, merely updating the driver on the disk will not correct the problem. The disk must be reformatted using the disk formatting software Apple supplies with the machine (Apple Drive Setup or Apple HD SC Setup), or a third-party utility such as Drive7, Silverlining, or Hard Disk Toolkit.

If you've already run NDD, experienced this problem, and want your data back, don't add files or try to correct the problem; instead, call Symantec technical support at 503/465-8440. They can talk you through a series of steps that should result in your recovering your data if you haven't added files or written data to the disk since the problem hit you.

Other Utility Software -- This problem seems to bite NDD harder than other disk recovery software. However, I've seen reports that Symantec's MacTools and even Apple's Disk First Aid have identified "uncorrectable" directory damage on disks with this problem. I have seen no confirmed reports of other utility programs causing damage or data loss on machines due to this problem; however, I also haven't seen confirmed reports of other utility programs fixing the problem or consistently identifying it. Even if you use a disk recovery program other than NDD, it might not hurt to use Disk Spot Check to determine if the problem might be present on your machine. If it is, I recommend either backing up and reformatting your drive or contacting your vendor's technical support to ask them what the recommended course of action might be. If you don't own a disk recovery tool and find the problem on your Mac, I'd recommend either backing up then reformatting your disk, or calling Apple at 800/SOS-APPL for information. In either case, you can also choose to let Disk Spot Check correct the problem.

Information from:
Apple Computer
Symantec Corporation


READERS LIKE YOU! Support TidBITS by becoming a member today!
Check out the perks at <http://tidbits.com/member_benefits.html>
Special thanks to David Vereschagin, Janusz Buda, William Ching, and
Cassio Gondim for their generous support!