How to identify and fix files with corrupted / inaccessible disk blocks

If you are facing a healthy file system at the level of its structure and want to find files which have disk faulty blocks, here is how I would proceed:

1. Make a full backup of your disk with Time Machine or Carbon Copy Cloner

   Check this backup.

2. Run the following heavy and risky (in case you do have bad blocks outside of your filesystem structure) command (make sure the {} is quoted so filenames containing spaces work):

   find / -type f -print -exec dd if="{}" of=/dev/null bs=1m \;
   

This heavy find command will print for any plain file its name (thus not reading it, but just its directory entry) and then continue making a full and fast read of all its data blocks.

Upon hiting the first file containing bad blocks, this find will cause the kernel to log read error on /var/log/system.log, and it will either slow down or bring your system to a total halt. This will mostly depend on the hard drive capacity to relocate the bad blocks found on its internal pool dedicated to this usual fix task. This file containing bad blocks will be the last name printed by find.

Write down this file name on a piece of paper! Let's say that this file name is:

/.DocumentRevisions-V100/.cs/ChunkStorage/0/0/0/9

At this point you may have the possibility to kill find quickly by hiting ctrl+C. If killing it nicely is failing, just crash your Mac.

Upon rebooting your Mac, directly check the file containing bad blocks:

dd if='/.DocumentRevisions-V100/.cs/ChunkStorage/0/0/0/9' of=/dev/null bs=1m

If the command terminate correctly, then the error was light enough for your disk to be able to read this file and reallocate the bad blocks.

• If the command doesn't terminate, you won't be able to kill it normally, your data is totally lost, and you will have to crash your Mac once more.

In this last case, you have to consider replacing your disk and to work from your last backups. Some other files might also contain bad blocks and may have stayed undetected since a long time as long as you didn't read them.

The kernel won't fire a read error on a block you never read.

Reboot in single user mode by holding the Command + S during boot. When you see a prompt (should look like root # or something similar), type fsck -f and press Return. This is Mac's built-in filesystem consistency check tool and allows you to find and repair errors with the startup file system. Run this command until you don't see **The volume [volume name] was modified.** or the tool fails three times in a row.

If the tool fails, it might be indicative of a larger problem (but I couldn't tell you what without seeing the output of the tool). In any case, make sure you've backed up everything you can before running any disk tool. When you've finished, type reboot into the prompt and press enter to (you guessed it!) reboot your computer.

For extra information you can find the fsck manual pages here.

I would highly recommend DiskWarrior for rebuilding disk catalogs and for scanning for potentially damaged files.

During the catalog rebuild, it can also let you know if it experiences a delay because of disk malfunction.

Working off Buscar's answer, you can do this automatically using some pretty heavy command line foo.

sudo find / -type f -print0  | xargs -0 -I{} dd if='{}' of=/dev/null bs=1m 2>&1 | grep 'error' >>badfiles.txt  & 

• sudo:Admin mode
• find -print0: absolute path
• xargs -0 -I{} : substitute {} in the next command
• dd 2>&1: redirect std error to stdout
• pipe stdout to grep looking for string error
• Append results to a list file.( note: This should be on external media if you believe your internal drive is iffy)

As you say, it is not even clear those files are damaged, at least your Mac does not thinks so.

Every OS makes unmovable files that are needed for its operations (Restore points, currently active files ect....). Some defrags will show them, some will not.

The fact that you can not access or move them does not mean they are damaged.

Normally Mac's are very good in taking care of them self.

Using Apple maintenance is done by: open the Terminal and type:

sudo periodic daily weekly monthly 

followed by Return, enter your Administrator password, and OS X will take care of things for you.

Look in the Console for the reports on those if you are interested.

While in the Console look (search) for any I/O errors that would indicate your disk is starting to have problems, to compliment the Disk Utility and the fsck findings.

On occasion I use a free tool called OnyX for additional maintenance task. It is made by French and as they food it is just great :)

_{OnyX is a multifunction utility for OS X which allows you to verify the startup disk and the structure of its system files, to run miscellaneous tasks of system maintenance, to configure some hidden parameters of the Finder, Dock, QuickTime, Safari, Mail, iTunes, login window, Spotlight, and many of Apple’s applications, to delete caches, to remove a certain number of files and folders that may become cumbersome, and more.}

With all this said, I am not questioning your decision for using the defragmenter (iDefrag) since I do not know it, but rather offering alternative solutions.