Every seasoned Mac user knows that the Mac file system is Mac OS Extended, known also as HFS+, and that you can use Disk Utility to partition hard drives into separate volumes, which you can clone, repair, and if you’re smart you can do even more using the diskutil command in Terminal.

Fewer Mac users are aware that, since OS X 10.7 Lion, Apple has been gradually changing this. Not only has Disk Utility lost the ability to check or repair permissions (because of the protection provided by SIP), but many of the disk management tools which used to work can now make a thorough mess of our drives.

This is most true for those with newer Macs which incorporate Apple’s Fusion Drive. But it can also affect anyone who has installed OS X 10.10 Yosemite, or 10.11 El Capitan. It additionally affects anyone who uses FileVault 2.0 full disk encryption.

How to tell whether your Mac is running CoreStorage on a drive

If you’re not sure whether your Mac is affected, open Disk Utility, and select the top level of your boot disk in its left pane (that is the hard drive itself, not the volume named “Macintosh HD” or whatever). If the main pane then describes it as a “CoreStorage Logical Volume Group”, your Mac has been converted to use CoreStorage rather than just plain old HFS+.

What CoreStorage is

CoreStorage (also referred to as Core Storage or various similar forms) is not a file system like HFS+, but a volume manager which operates between partitions and the HFS+ file system. It allows relative independence between logical volumes and physical storage: it can pool several physical volumes to form a Logical Volume Group (LVG), in just the way that it does for Apple’s Fusion Drives, which are made up of an SSD and a conventional hard drive.

Compatibility with CoreStorage

The snag in dealing with LVGs is that many of the tools and utilities which work on plain old HFS+ either do not work any more, or may actually screw up the whole LVG so as to render it unusable. So if your Mac is running off an LVG, you need to be fully aware of that, and use tools and techniques which will respect that LVG, and not blow it to pieces.

Disk Utility is good, particularly in El Capitan, where it is now the safest tool for dealing with CoreStorage LVGs, including Fusion Drives and full disk encryption. The best way to use it is to start up in Recovery Mode, either locally (Command-R) or remotely (Command-Option-R), and run Disk Utility from there.

Old tricks, such as starting up in Single-User Mode (SUM, Command-S) and trying to use the fsck command line repair tool, are now generally bad news. There is a special version of fsck to handle CoreStorage LVGs, but you are risking the volume contents once you start meddling with it.

The latest versions of third-party disk repair, recovery, and other utilities may or may not work properly with El Capitan’s implementation of CoreStorage. Before using any such tool, you must ensure that it is fully up to date, and that its documentation states explicitly that it works with CoreStorage LVGs, if your Mac uses them.

There are plenty of new tricks which are available, beyond creating your own Fusion Drive, although they are likely to remain minority sports. You can group your own storage devices into LVGs and treat them as single volumes, for example, like partitioning in reverse. With El Capitan’s new version of Disk Utility, you should not need to do this at the command line, although most users will not want to do it at all.

Terminal tools

For those who must work in the command shell, there is a group of new commands which you will need to become familiar with.

diskutil is the master tool for most operations involving CoreStorage, through its verb coreStorage, which can be abbreviated to cs. The more generally useful CoreStorage sub-verbs include:

• list to display a tree view of current CoreStorage objects (safe to use);
• info to display properties of a specified CoreStorage object (safe to use);
• convert to convert a plain old journalled HFS+ volume into a CoreStorage logical volume (beware);
• create to create an LVG (beware);
• delete to delete an LVG and erase its constituent volumes (extreme caution);
• rename to rename an LVG (beware);
• createVolume to export a new LV family from an LVG (beware);
• deleteVolume to remove an exported LV from an LVG, losing all data on that LV (extreme caution);
• various resizing sub-verbs such as resizeVolume, resizeDisk, and resizeStack (beware);
• various sub-verbs concerned with encrypted LVGs (extreme caution).

Many of these are data-destructive, so I have indicated those which require greatest care in use. Fuller details are of course available through man diskutil, but at present there does not appear to be any explanatory material in the Xcode documentation set, nor on Apple’s developer website. Some interesting exploratory work is reported and discussed here on Reddit.

fsck_cs verifies and repairs CoreStorage LVGs, much in the same way that fsck_hfs does for plain old HFS+ volumes. Just as for that, Apple cautions that it does not perform an exhaustive validation, and is unable to fix many of the faults that it does detect.

csunique modifies the Unique UIDs (UUIDs) of CoreStorage objects such as LVGs.

corestoraged is the CoreStorage volume manager, which is called by launchd when an LVG needs to be managed, and should not be called by the user.