4

I posted this in the Apple Discussions forums, but have yet to get an answer that applies to the depth of which this situation currently exists.

My Mac's hard drive (running Mojave) suffered some corruption recently, and I found myself unable to boot into the system. I am able to boot into Recovery Mode, and my intent was to rescue the important data sitting in /Users/(my username), but to my surprise, the entire /Users/ folder is just not there when I try to access it via Terminal.

Steps taken:

  1. Boot into Recovery Mode.
  2. Open up Terminal.
  3. Navigate to /Volumes/(my OS drive name)/
  4. Type ls to see directory tree. I see every other folder I am expecting to see (I think), except for /Users/. It simply is not there.

What I have tried:

  1. Navigating to literally every partition and folder I can think of to find where /Users/ might be instead.
  2. Doing "chflags nohidden" on the drive does nothing.
  3. I don't believe I have FileVault on, so I don't think anything in that category would apply to my situation.

I can only come up with two possible conclusions:

  1. The hard drive corruption annihilated ONLY the /Users/ directory (unlikely, I assume???)
  2. Recovery Mode is hiding /Users/ in a way that I cannot figure out, and this is apparently not documented anywhere on the internet. I have seen other sites/posts talking about /Users/ being hidden, but they were not referring to situations similar to mine, and were resolved with simple (somewhat obvious) steps. They were not like what I am experiencing.

In the meantime, preparing for the worst, I have ordered an external drive enclosure so that I can pull the drive out of my computer and view its contents on another computer.

I am very hesitant to reinstall MacOS right now, because IF /Users/ has been compromised in the corruption, I don't want to do anything further that will prevent it from being recovered somehow. In other words, I am trying not to write any new data to the drive at all.

Thanks for any help or suggestions in advance.

  • I'm finding your description confusing. Since /Users starts with a slash, it's explicitly at the root of the current system volume; the Recovery root doesn't have a Users folder in it, so /Users is not expected to exist. Your regular users folder should be at /Volumes/(my OS drive name)/Users instead (and note that if the volume name has any spaces in it, you'll have to quote or escape it appropriately). So... are you looking for /Users, or are are you looking for Users (note no slash) in /Volumes/(my OS drive name)? – Gordon Davisson Apr 11 at 0:54
  • I'm sorry for typing it that way, I was trying to type it quickly by saying "/Users/", meaning not the term "users" or something else... but what I really meant was "Users folder", as in the folder wherein all user folders exist, yes. In Terminal, this was literally my command: cd /Volumes/MacOS/Users . That is where it always is, no? – agrafuese Apr 11 at 2:33
  • 1
    Could you show us actual Terminal output for an ls command showing the contents of /Volumes/MacOS. Also - no backup? – benwiggy Apr 11 at 7:50
  • Thanks for asking, benwiggy. Unfortunately, after putting the drive into an enclosure and checking on another computer, the Users folder is indeed missing. I have no idea how or why, and yes, I feel very dumb for not having a backup. My fault, and now all I can do is hope that I can recover the data somehow. – agrafuese Apr 12 at 2:31
  • How did you eventually find "/User/yourname?" I can find "/User/shared," altho there is nothing inside. – aeroxy Sep 3 at 16:36
2

This is normal. When you boot in to Recovery, whether it be from your local drive or via the Internet, you’re booting a completely different instance of macOS.

If you want to view the /Users directory, you’ll first have to mount the internal drive to a directory (i.e. /Volumes) then you can navigate to it.

As for corruption of your drive, it is better to get an enclosure or a USB to SATA adapter, mount it on a “full blown” version of macOS so you can make an image of the drive and work off of that rather than risk further data loss.

| improve this answer | |
  • 2
    I understand what you're saying, but I don't understand why every other folder I always see on a day-to-day basis IS showing up. Literally every folder, even Applications. When I look at Applications, all of my applications are in it. So, are you saying that the Users folder is on some other partition? As I mentioned to a previous commenter, my command was literally this: cd /Volumes/MacOS/Users. In other words, the MacOS "main folder" aka my "root" was already mounted when I entered Terminal in the Recovery Mode. So, I don't know what else I would be mounting besides that. – agrafuese Apr 11 at 2:37
  • Like what folders? And yes, the users folder is actually in a different container. Usually the name of your drive wit -data appended to it – Allan Apr 12 at 9:19
  • In my main mac os drive/partition (aka what someone sees when they click on the hard drive in Finder, in a normal working scenario), I have Applications, Library, and System. That's all. Inside those folders is everything I would expect to see (i.e. the applications I installed, etc). However, there is no Users folder anywhere. When I do a diskutil list I'm not seeing anything with "-data" appended to it. Is that something hidden that requires additional commands to be seen? – agrafuese Apr 12 at 15:57
  • For reference, this is what comes up when I do a diskutil list - NOTE: I am only showing the part that is related to this drive and I have temporarily renamed the partition "Lost" to differentiate it from other partitions, because I have taken the drive out of my computer, placed it into an enclosure, and have it connected to another computer [dropbox.com/s/hd3a2uvmrayrt3q/… – agrafuese Apr 12 at 15:58
  • 1
    Ahhh...I see what's happening. Issue this command - diskutil apfs list. You will then see all of the containers. Here's a similar output of what you'll see. I've highlighted the two different APFS volumes that point to the "same" data: dropbox.com/s/56rxak9iraqric5/APFS%20Output.png?dl=0 – Allan Apr 12 at 22:56
1

I was able to use Disk Drill recovery software set to "deep scan" on the entire contents of the physical drive - and somehow, the software was able to reveal the Users folder. Thankfully, I was able to extract everything I needed from there (as well as files I didn't even want anymore, but that's a small price to pay).

I cannot offer any explanations for why nothing else seemed to work in getting the Users folder to be visible in Terminal/sudo, whether in Recovery Mode or after taking the drive to another computer, regardless of many different ways of initiating chflags -R nohidden on the ENTIRE partition, trying extremely convoluted chmod settings, verifying permissions, manually searching every folder I could imagine, mounting the partition in every way I know how, even trying to mount OTHER partitions on the physical disk that clearly were unrelated to the partition in question. I'm sure I'm forgetting a handful of other things that I tried along the way as well - and trust me when I say I tried everything I could find, even beyond the suggestions on this site, and I tried them correctly, with nearly 20 years of Mac experience under my belt. That's not to say I am a perfect human by any means (obviously), but I am also not a fumbling noob when it comes to this stuff.

I have no doubt that in time, someone will see this thread and have a definitive answer for the troubles I experienced. I absolutely encourage that person to offer their knowledge to the world, because whatever the true solution was, it is not well documented knowledge as of the time of this writing. Either that, or it was something so specific to my situation that it proved crippling and against the normal workings of macOS as a whole.

| improve this answer | |
0

Instead of removing the SSD, you can try using Target Disk mode. This allows you to boot from the Internal SSD on another computer. Try checking the /var directory. Have you tried First Aid on Macintosh HD (or whatever the OS Drive is)? Reinstalling macOS does not affect any settings or user data so that isn't something to worry about. Can you see an entry for your user accounts in /Volumes/(OS Drive)/etc/passwd? If you don't then that means that all your user accounts have been deleted. If you would like, you can also check /var/db/dslocal/nodes/Default/users and check if there are any .plist files for your user(s). You can also try installing macOS on an external hard drive using macOS Recovery then try booting up on the external drive to see if you can see the /Users directory on the Internal SSD. Good Luck!

| improve this answer | |
  • Thank you for the Target Disk suggestion, but due to the specifics of my hardware (incompatible connectors), this wouldn't work. There are items in /var, but I'm not sure that any of them hold anything I'm interested in. /etc/passwd has contents, but (and I checked this file on my other working mac to see how they compare) there isn't anything specifically tied to my user account, only services/apps and things. Since my other mac's passwd file looks similar, I am not concerned. The good news is, there is a .plist for my user in /var/db/dslocal/nodes/Default/users. – agrafuese Apr 11 at 6:03
  • I am going to see how far I get with the external enclosure idea I mentioned. My concern now is that maybe I actually did have filevault on and never realized it. I read something that said modern versions of MacOS turn it on by default, and this was something I never thought to even check before. So now I'm worried my files will be locked on the external enclosure (?). My only remaining option in that case might be to reinstall the OS, as you've said, and just hope that the corruption doesn't worsen/ruin my data further. Thank you for all of your suggestions. – agrafuese Apr 11 at 6:07
  • Oh, and yes, I did try First Aid in the beginning of all of this, and it failed (sorry, I can't remember the error it threw, but it was impassable). – agrafuese Apr 11 at 6:09
  • If you have access to the directories on your Macintosh HD disk, then you do not have FileVault. Can you try reinstalling macOS? That will not get rid of any data. This might also be an issue with your macOS Recovery so try fixing this using a bootable macOS Installer. Here is the link to do that: support.apple.com/en-us/HT201372. I doubt that this will work but you can try using Single User mode and then fsck_apfs. Good luck! – Todd Apr 11 at 22:03
  • Also, could your /Users directory be hidden? This is very insecure but you can try searching using sudo chmod 744 -R / This will give every user read permissions and the owner (system) read, write, and execute. I know that you mentioned that you tried un-hiding it but this might help. Also, you could try using diskutil verifyDisk <diskIdentifier> to verify permissions. Good luck again! – Todd Apr 11 at 22:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .