Kernel Panic at boot, and APFS not mountable in Utilities

[Dunatotatos]

Hi all,

I'm trying to fix a MacBook Pro which goes into an infinite loop of reboot. This laptop is not mine, and I do not know exactly what happened before. Also, I'm not a Mac user, so sorry if I miss some basic things...

When turning the laptop on, the Apple logo and progress bar appear, followed by a kernel panic. The multi-language message "Your computer restarted because of a problem.[...]" stays on the screen for a few seconds, and the laptop restarts, displays the logo and a progress bar, and kernel panic, ...

I've fixed this issue a first time by going in Rescue mode, mounting the main Volume, figuring out the kernel panic was due to a kernel module named nCryptedCloud, and moved away the file Library/osxmonitor.kext/Contents/Resources/com.ncryptedcloud.osxmonitor.autoload.plist. OK, this last step might not be very smart. But hey, it worked! The laptop started as expected without a kernel panic.

I've given back the laptop to its owner, who rebooted the machine. After a reboot, the kernel panic at the boot time was back. Thinking that nCryptedCloud wrote back the same file, I wanted to boot in Rescue Mode, move again the same file somewhere else, reboot, and simply remove nCryptedCloud from the Operating System.

Here we go, I reboot in Rescue Mode. The partition containing the OS and the user data is not mounted by default. I figured out the partition was using APFS. I used diskutil. Here is the output (not complete, as I have to copy by hand).

# diskutil ap list
APFS Container (1 found)
|
+-- Container disk1 [...]
    =================
    APFS Container Reference: disk1
    Capacity Ceiling (Size): 1985446547456 B (2.0 TB)
    Capacity in Use By Volumes: 813573115904 B (813.6 GB) (41.0% used)
    Capacity Available: 1171873431552 B (1.2 TB) (59.0% free)
    |
    +-< Physical Store disk0s2 [...]
    |   -------------------------------
    |    APFS Physical Store Disk: disk0s2
    |    Size: 1985446547456 B (2.0 TB)
    |
    +-> Volume ERROR -69808
    |   --------------------------
    |   APFS Volume Disk (Role): disk1s1 (No specific role)
    |   Name: ERROR -69808
    |   Mount Point: Not Mounted
    |   Capacity Consumed: 811672514560 B (811.7 GB)
    |   Capacity Reserve: None
    |   Capacity Quota: None
    |   Cryptographic Security: None
    |
    |-> Volume disk1s2 [...]
    |   -----------------------
    |   APFS Volume Disk (Role): disk1s2 (Preboot)
    |   Name: Preboot
    |   [...]
    |
    |-> Volume disk1s3 [...]
    |   -----------------------
    |   APFS Volume Disk (Role): disk1s3 (Recovery)
    |   Name: Recovery
    |   [...]
    |
    |-> Volume disk1s4 [...]
    |   -----------------------
    |   APFS Volume Disk (Role): disk1s4 (VM)
    |   Name: VM
    |   [...]

The Volume ERROR -69808 is the one containing the OS and the user data. I've tried mounting it, without success:

# diskutil mount disk1s1
Volume on disk1s1 failed to mount
If the volume is damaged, try the "readOnly" option
# diskutil mount readOnly disk1s1
Volume on disk1s1 failed to mount
If the volume is damaged, try the "readOnly" option

Each mounting trial gives this line in /var/log/system.log:

MacBook-Pro diskutil[553]: Mount of disk1s1 blocked by dissenter PID=0 (kernel) status=0xf8da000c (kDAReturnUnsupported)

I've then tried to check the volume:

# diskutil verifyVolume disk1s1
Error starting file system verification for disk Unrecognized file system (-69846)

I might be wrong, but I seriously doubt the file system is corrupted, as keeping the Option button pressed during the boot gives me the option of booting on this partition (named MAC HD), and displays the Apple logo and a progress bar (followed by a Kernel Panic, but this is probably another issue).

Could you help me to either fix the Kernel Panic, or mount the MAC HD (disk1s1) in Recovery Mode?

Thanks a lot in advance for your help!

Best,
Duna

 

[Dunatotatos]

Problem solved. I was pressing Cmd+R a bit too early. If I let the Operating System start, and press Cmd+R while the logo and the progress bar are displayed, I guess the Mac HD partition is mounted, planned to be used to load the OS. But then the normal loading is interrupted to load the Recovery tools instead. Mac HD is however still mounted, and I can access it to copy the user data or do any maintenance task.

The solution is not really clean, but it works.

Thanks all for your help!

Best,
Duna