{"id":5118,"date":"2012-06-22T17:42:22","date_gmt":"2012-06-22T21:42:22","guid":{"rendered":"http:\/\/mjtsai.com\/blog\/?p=5118"},"modified":"2021-06-30T16:33:02","modified_gmt":"2021-06-30T20:33:02","slug":"beware-a-full-recovery-partition","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2012\/06\/22\/beware-a-full-recovery-partition\/","title":{"rendered":"Beware a Full Recovery Partition"},"content":{"rendered":"

Little Snitch<\/a> is the only third-party kernel extension that I use. I doubt that it’s the cause of the kernel panics I’ve been having, but I wanted to temporarily uninstall it just to be sure. I ran the uninstaller, which said it was successful, but the bundle identifier was still showing up in my kernel panic logs and in kextstat<\/tt>’s list of currently installed extensions. This was strange because I could see that the .kext<\/tt> file had indeed been deleted from the \/System\/Library\/Extensions<\/tt> folder.<\/p>\n

Even stranger, the logs showed version 2.5.1, when I’d had 2.5.2 installed for over a month. It seemed that Mac OS X’s kernel extension cache wasn’t being updated. I found various tips online, such as sudo touch<\/tt>ing the installed kernel extensions or removing the folder \/System\/Library\/Caches\/com.apple.kext.caches<\/tt>. None of these helped.<\/p>\n

I then tried manually unloading the kernel extension:<\/p>\n

icarus$ sudo kextunload -v -b at.obdev.nke.LittleSnitch\n(kernel) Can't remove kext at.obdev.nke.LittleSnitch; services failed to terminate - 0xe00002c7.\nFailed to unload at.obdev.nke.LittleSnitch - (iokit\/common) unsupported function.\nJun 21 10:37:46 icarus com.apple.kextcache[92]: Error copying \/\/System\/Library\/Caches\/com.apple.corestorage\/EncryptedRoot.plist.wipekey to \/Volumes\/Recovery HD\/com.apple.boot.R\/System\/Library\/Caches\/com.apple.corestorage\/EncryptedRoot.plist.wipekey\nJun 21 10:37:46 icarus com.apple.kextcache[92]: ucopyRPS - Error copying files used by the booter. errno 28 No space left on device<\/pre>\n
The error shows that the OS was trying to copy to the “Recovery HD” partition for Lion Recovery<\/a>, but the partition was full. Apparently it was aborting without updating the cache on my main partition (which was not full). I used diskutil<\/tt> to mount the “Recovery HD” partition, and sure enough it only had about 40KB free.<\/p>\n
Live-resizing the partitions didn’t seem to be possible, so I reformatted my drive and reinstalled Lion, which created a fresh recovery partition (now called “Boot OS X”, for some reason), which has 128 MB free. Now there’s enough space for the system to automatically update the kernel extension cache.<\/p>\n
Sidenote: While trying to free up some space on the recovery partition, to avoid having to repartition, I inadvertently messed something up and rendered the main<\/em> partition unbootable. Since there doesn’t seem to be a convenient way to create a new recovery partition, it’s probably a good idea to keep a backup. I’m going to create a device image of mine using DropDMG<\/a>. I also learned<\/a> that Carbon Copy Cloner<\/a> can do this automatically when backing up the main partition.<\/p>","protected":false},"excerpt":{"rendered":"
Little Snitch is the only third-party kernel extension that I use. I doubt that it’s the cause of the kernel panics I’ve been having, but I wanted to temporarily uninstall it just to be sure. I ran the uninstaller, which said it was successful, but the bundle identifier was still showing up in my kernel […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2021-06-30T20:33:06Z","apple_news_api_id":"236da212-8644-442d-8035-b5f738fe5713","apple_news_api_modified_at":"2021-06-30T20:33:06Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/AI22iEoZERC2ANbX3OP5XEw","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[30,2088],"class_list":["post-5118","post","type-post","status-publish","format-standard","hentry","category-technology","tag-mac","tag-macos-recovery"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/5118","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=5118"}],"version-history":[{"count":5,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/5118\/revisions"}],"predecessor-version":[{"id":14784,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/5118\/revisions\/14784"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=5118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=5118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=5118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}