Increase disk size of a UTM macOS VM and expand its APFS container

Increasing a UTM virtual disk's size does not automatically expand the guest's APFS container. If a Recovery partition lies between the container's partition and the added free space, it blocks direct expansion.

This Codex/Astra-crafted script uses Python 3.9+ standard library and macOS diskutil, cp, and lsof; no pip packages, Go, Homebrew, or QEMU are required. It targets macOS 26+ with diskutil image support and an APFS host filesystem for copy-on-write backups:

#!/usr/bin/env python3

# Grow an offline Apple Silicon UTM image. Python stdlib + macOS diskutil/cp.

import argparse
import hashlib
import json
import os
from pathlib import Path
import plistlib
import re
import struct
import subprocess
import sys
import uuid
import zlib

RECOVERY = uuid.UUID('52637672-7900-11aa-aa11-00306543ecac').bytes_le
APFS = uuid.UUID('7c3457ef-0000-11aa-aa11-00306543ecac').bytes_le
ISC = uuid.UUID('69646961-6700-11aa-aa11-00306543ecac').bytes_le
CHUNK = 8 * 1024 * 1024


def require(ok, message):
    if not ok:
        raise ValueError(message)


def read_at(fd, length, offset):
    data = os.pread(fd, length, offset)
    require(len(data) == length, 'Short read at %d' % offset)
    return data


def write_at(fd, data, offset):
    while data:
        n = os.pwrite(fd, data, offset)
        require(n > 0, 'Short write at %d' % offset)
        offset += n
        data = data[n:]


def header(fd, sector, lba, total):
    raw = bytearray(read_at(fd, sector, lba * sector))
    require(raw[:8] == b'EFI PART', 'Missing GPT signature')
    revision, length, checksum, reserved = struct.unpack_from('<4I', raw, 8)
    require(revision == 0x10000 and 92 <= length <= sector and reserved == 0,
            'Unsupported GPT header')
    struct.pack_into('<I', raw, 16, 0)
    require(zlib.crc32(raw[:length]) == checksum, 'GPT header CRC mismatch')
    struct.pack_into('<I', raw, 16, checksum)
    current, backup, first, last = struct.unpack_from('<4Q', raw, 24)
    table, count, entry_size, crc = struct.unpack_from('<Q3I', raw, 72)
    require(current == lba and 1 <= backup < total and backup != current,
            'Invalid GPT header locations')
    require(2 <= first <= last < total, 'Invalid usable GPT bounds')
    require(0 < count <= 16384 and entry_size >= 128 and entry_size % 128 == 0
            and count * entry_size <= 16 * 1024 * 1024, 'Invalid GPT array dimensions')
    sectors = (count * entry_size + sector - 1) // sector
    require(table >= 2 and table + sectors <= total, 'GPT array outside disk')
    padded = read_at(fd, sectors * sector, table * sector)
    entries = padded[:count * entry_size]
    require(zlib.crc32(entries) == crc, 'GPT partition array CRC mismatch')
    return dict(raw=raw, length=length, current=current, backup=backup, first=first,
                last=last, table=table, count=count, entry_size=entry_size,
                entries=entries, sectors=sectors)


def inspect(fd, sector, size):
    require(sector in (512, 4096) and size % sector == 0, 'Unsupported disk geometry')
    total = size // sector
    mbr = read_at(fd, sector, 0)
    require(mbr[510:512] == b'\x55\xaa', 'Missing protective MBR')
    require(mbr[450] == 0xee and mbr[446+16:510] == bytes(48),
            'Unsupported hybrid or non-protective MBR')
    h = header(fd, sector, 1, total)
    b = header(fd, sector, h['backup'], total)
    require(b['backup'] == 1 and h['raw'][56:72] == b['raw'][56:72]
            and h['first'] == b['first'] and h['last'] == b['last']
            and h['count'] == b['count'] and h['entry_size'] == b['entry_size']
            and h['entries'] == b['entries'], 'GPT copies disagree; restore backup before retrying')
    require(h['table'] == 2 and h['table'] + h['sectors'] <= h['first']
            and b['table'] > h['last'] and b['table'] + b['sectors'] == b['current'],
            'Unsupported GPT metadata layout')
    parts = []
    for i in range(h['count']):
        e = h['entries'][i*h['entry_size']:(i+1)*h['entry_size']]
        if e[:16] == bytes(16):
            continue
        start, end = struct.unpack_from('<QQ', e, 32)
        require(h['first'] <= start <= end <= h['last'], 'Partition outside usable bounds')
        parts.append(dict(index=i+1, type=e[:16], start=start, end=end,
                          name=e[56:128].decode('utf-16-le').rstrip('\0')))
    ordered = sorted(parts, key=lambda p: p['start'])
    require(all(a['end'] < b['start'] for a,b in zip(ordered, ordered[1:])),
            'Overlapping GPT partitions')
    # Deliberately narrow: no ambiguous targets, extra disks, or guessed recovery sources.
    require([p['type'] for p in ordered] == [ISC, APFS, RECOVERY],
            'Expected exactly ISC, main APFS, and Recovery partitions in that order')
    recovery = ordered[-1]
    sb = read_at(fd, max(sector, 4096), recovery['start'] * sector)
    require(sb[32:36] == b'NXSB', 'Recovery has no APFS superblock; refusing guessed repair')
    blocksize, blocks = struct.unpack_from('<IQ', sb, 36)
    require(blocksize in (4096, 8192, 16384, 32768, 65536)
            and blocks * blocksize == (recovery['end']-recovery['start']+1)*sector,
            'Recovery APFS size does not match its GPT partition')
    last = total - h['sectors'] - 2
    length = recovery['end'] - recovery['start'] + 1
    # Preserve APFS block alignment, leaving at most one APFS block at the end.
    align = max(blocksize, sector) // sector
    start = ((last - length + 1) // align) * align
    require(start >= recovery['start'], 'Shrinking is not supported')
    require(start == recovery['start'] or start > recovery['end'],
            'Growth smaller than Recovery size is unsupported (copy would overlap)')
    return h, parts, dict(source=recovery['start'], destination=start,
                         sectors=length, last=last, index=recovery['index'],
                         main_index=ordered[1]['index'], block_size=blocksize)


def digest(fd, offset, length):
    result = hashlib.sha256()
    for off in range(0, length, CHUNK):
        result.update(read_at(fd, min(CHUNK, length-off), offset+off))
    return result.hexdigest()


def make_header(h, current, backup, table, last, entries):
    raw = bytearray(h['raw'])
    struct.pack_into('<QQ', raw, 24, current, backup)
    struct.pack_into('<Q', raw, 48, last)
    struct.pack_into('<Q', raw, 72, table)
    struct.pack_into('<I', raw, 88, zlib.crc32(entries))
    struct.pack_into('<I', raw, 16, 0)
    struct.pack_into('<I', raw, 16, zlib.crc32(raw[:h['length']]))
    return raw


def relocate(fd, sector, size):
    h, parts, plan = inspect(fd, sector, size)
    print('Relocation:', json.dumps(plan), flush=True)
    src, dst, length = (plan[k]*sector for k in ('source', 'destination', 'sectors'))
    if src == dst:
        print('Recovery already at the aligned end of disk.', flush=True)
        return plan
    source_hash = digest(fd, src, length)
    for off in range(0, length, CHUNK):
        write_at(fd, read_at(fd, min(CHUNK, length-off), src+off), dst+off)
    os.fsync(fd)
    require(digest(fd, dst, length) == source_hash, 'Recovery copy SHA-256 mismatch; GPT untouched')
    print('Recovery SHA-256 verified:', source_hash, flush=True)
    entries = bytearray(h['entries'])
    struct.pack_into('<QQ', entries, (plan['index']-1)*h['entry_size']+32,
                     plan['destination'], plan['destination']+plan['sectors']-1)
    padded = entries + bytes(h['sectors']*sector-len(entries))
    end = size//sector-1
    backup_table = end-h['sectors']
    # Copy first, then backup GPT, then primary GPT. An interrupted metadata commit
    # fails validation on rerun; the mandatory image backup is the rollback path.
    write_at(fd, padded, backup_table*sector)
    write_at(fd, make_header(h, end, 1, backup_table, plan['last'], entries), end*sector)
    os.fsync(fd)
    write_at(fd, padded, h['table']*sector)
    write_at(fd, make_header(h, 1, end, h['table'], plan['last'], entries), sector)
    mbr = bytearray(read_at(fd, sector, 0))
    struct.pack_into('<I', mbr, 458, min(end, 0xffffffff))
    write_at(fd, mbr, 0)
    os.fsync(fd)
    inspect(fd, sector, size)
    return plan


def run(*args, plist=False):
    print('+', ' '.join(str(a) for a in args), flush=True)
    result = subprocess.run([str(a) for a in args], check=True, stdout=subprocess.PIPE)
    if plist:
        return plistlib.loads(result.stdout)
    print(result.stdout.decode(), end='', flush=True)
    return result.stdout


def attach(path, readonly=False):
    args = ['diskutil', 'image', 'attach', '--noMount', '--plist']
    if readonly:
        args.append('--readOnly')
    data = run(*args, path, plist=True)
    nodes = [e['dev-entry'] for e in data['system-entities']
             if e.get('content-hint') == 'GUID_partition_scheme']
    require(len(nodes) == 1, 'Expected one GPT device from image attachment')
    return '/dev/' + nodes[0].removeprefix('/dev/')


def device_info(dev):
    info = run('diskutil', 'info', '-plist', dev, plist=True)
    require(info.get('WholeDisk') and info.get('BusProtocol') == 'Disk Image'
            and not info.get('Internal'), 'Refusing a non-image or internal device')
    return info['DeviceBlockSize'], info['TotalSize']


def image_path(path):
    path = path.resolve(strict=True)
    if path.suffix == '.utm' and path.is_dir():
        with open(path/'config.plist', 'rb') as f:
            config = plistlib.load(f)
        require(config.get('Backend') == 'Apple', 'Only Apple Virtualization VMs supported')
        drives = [d for d in config['Drive'] if not d.get('ReadOnly') and d.get('ImageName')]
        require(len(drives) == 1, 'Select the image explicitly for a multi-drive VM')
        image = (path/'Data'/drives[0]['ImageName']).resolve(strict=True)
        require(image.parent == path/'Data', 'Image path escapes VM bundle')
        return image
    require(path.is_file(), 'Pass a .utm bundle or disk image file, never a device')
    return path


def check_idle(path):
    p = subprocess.run(['/usr/sbin/lsof', '-t', str(path)], capture_output=True)
    require(p.returncode in (0, 1), 'Cannot check image users with lsof')
    require(not p.stdout.strip(), 'Image is open: shut down VM and detach image first')


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('image', type=Path)
    parser.add_argument('--size-gib', type=int, required=True, help='Target virtual capacity in GiB')
    parser.add_argument('--apply', action='store_true', help='Otherwise inspect only')
    parser.add_argument('--backup', type=Path, help='Required new backup image path with --apply')
    args = parser.parse_args()
    path = image_path(args.image)
    require(args.size_gib > 0, 'Size must be positive')
    require(not args.apply or args.backup is not None, '--apply requires --backup PATH')
    check_idle(path)
    dev = attach(path, readonly=True)
    try:
        sector, size = device_info(dev)
        with open(dev.replace('/dev/disk', '/dev/rdisk'), 'rb', buffering=0) as f:
            h, parts, plan = inspect(f.fileno(), sector, size)
            recovery_hash = digest(f.fileno(), plan['source']*sector, plan['sectors']*sector) if args.apply else None
        target = args.size_gib * 1024**3
        require(target >= size, 'Refusing to shrink image')
        recovery_bytes = plan['sectors']*sector
        require(target == size or target-size > recovery_bytes,
                'Growth must exceed recovery size for non-overlapping relocation')
        print(json.dumps(dict(image=str(path), old_bytes=size, target_bytes=target,
                              recovery_bytes=recovery_bytes), indent=2), flush=True)
    finally:
        run('diskutil', 'eject', dev)
    if not args.apply:
        return
    backup = args.backup.absolute()
    require(not backup.exists() and not backup.is_symlink(), 'Backup path must not exist')
    backup.parent.mkdir(parents=True, exist_ok=True)
    check_idle(path)
    # Native APFS clone; -n prevents accidental overwrite. Fail if cloning unavailable.
    run('/bin/cp', '-c', '-p', '-n', path, backup)
    require(backup.is_file() and backup.stat().st_size == path.stat().st_size,
            'Backup verification failed')
    print('Rollback image:', backup, flush=True)
    if target > size:
        run('diskutil', 'image', 'resize', '--image-only', '--size', str(target), path)
    dev = attach(path)
    try:
        sector, actual = device_info(dev)
        require(actual == target, 'Image capacity differs from target')
        run('diskutil', 'unmountDisk', dev)
        with open(dev.replace('/dev/disk', '/dev/rdisk'), 'r+b', buffering=0) as f:
            plan = relocate(f.fileno(), sector, actual)
            require(digest(f.fileno(), plan['destination']*sector, plan['sectors']*sector) == recovery_hash,
                    'Recovery changed during image resize; restore backup before proceeding')
            print('Original Recovery SHA-256 preserved:', recovery_hash, flush=True)
    finally:
        run('diskutil', 'eject', dev)
    # Reattach so the kernel re-reads GPT; no Linux ioctl.
    dev = attach(path)
    try:
        run('diskutil', 'apfs', 'resizeContainer', dev+'s'+str(plan['main_index']), '0')
        run('diskutil', 'verifyDisk', dev)
        with open(dev.replace('/dev/disk', '/dev/rdisk'), 'rb', buffering=0) as f:
            _, final_parts, final_plan = inspect(f.fileno(), sector, actual)
        main_part = next(p for p in final_parts if p['type'] == APFS)
        require(main_part['end']+1 == final_plan['source'], 'Main APFS did not fill available space')
        run('diskutil', 'list', dev)
    finally:
        run('diskutil', 'eject', dev)
    print('Completed. Backup retained at', backup, flush=True)


if __name__ == '__main__':
    try:
        main()
    except (ValueError, OSError, subprocess.CalledProcessError) as exc:
        print('ERROR:', exc, file=sys.stderr)
        sys.exit(1)

Usage

Shut down the VM and do not start it while the script runs. Pass either the .utm bundle or its writable disk image. Inspection is the default:

python3 resize_utm.py '/path/macOS.utm' --size-gib 200

Apply the change, creating a new mandatory image backup first:

python3 resize_utm.py '/path/macOS.utm' --size-gib 200 --apply --backup '/path/macOS-before.img'

The size is GiB, so 200 means 214,748,364,800 bytes (Disk Utility displays about 214.7 GB). An initial 120 GiB image therefore gains 80 GiB. The main APFS container is smaller than the disk because ISC and outer Recovery retain their space.

What it does

Resolves the single writable image from an Apple-backend UTM bundle, or accepts an image directly. Rejects physical devices, images currently open by another process, shrinking, and unexpected partition layouts.
Attaches read-only for inspection. Validates both GPT headers and partition arrays, their CRCs, partition bounds/order, and Recovery's APFS superblock geometry.
With --apply, hashes the entire Recovery partition and creates a native APFS clone backup of the image.
Uses diskutil image resize --image-only to grow the image. On a tested macOS 27 build, this already relocates Recovery for ASIF images.
If needed, relocates Recovery itself through the attached raw device. It derives usable space from actual device capacity and GPT array dimensions, preserves APFS block alignment, copies and SHA-256-verifies Recovery before updating GPT, and writes both GPT copies with new CRCs. Partition IDs, names, attributes, and unrelated entries are preserved.
Checks Recovery against its original full SHA-256, detaches/reattaches to refresh the kernel's partition map, and expands the main APFS container using diskutil apfs resizeContainer ... 0.
Verifies the partition map and checks the final GPT layout fills the space up to Recovery. APFS's resize operation also performs a filesystem consistency check.

Only exactly three outer partitions, in physical order ISC / APFS / Apple_APFS_Recovery, are supported. Matching uses the Recovery type GUID, not a guessed name. Raw and ASIF image interpretation is delegated to macOS. The relocation core supports 512- and 4096-byte logical sectors. Growth smaller than or equal to Recovery's size is deliberately refused to avoid an overlapping copy. Already-grown images can be completed by requesting their existing capacity.

Failure and rollback

This is not a crash-atomic disk transaction. A crash during GPT commit can leave its copies inconsistent; validation then fails closed. The script does not infer missing Recovery data from an NXSB signature, and does not attempt to repair a partially executed third-party resizer. The retained image backup is the rollback source. A copy interruption before GPT commit leaves the original Recovery and GPT intact, although unused destination space may have changed.

If anything fails, leave the VM stopped. Eject any attachment listed in the log before restoring. Replace the modified image with a copy of the retained backup at the exact original image path. Do not restore only the old GPT after APFS growth.

An encrypted/locked APFS guest may require unlocking its Data volume before APFS expansion; the script reports the native error rather than asking for or recording passwords. Do not launch UTM or attach the image in another app during the run; the initial open-file check is not an exclusive lock against other applications.

References

The workflow is based on the UTM discussion and yunyang088's Go resizer. The discussion documents the stale-GPT-end bug, fixed here by computing geometry from actual device capacity. This implementation takes a different interruption strategy: verified nonoverlapping copy before GPT publication, with a mandatory whole-image backup for rollback.

Postscript

Briefly removed this post after an update to macOS 26.7 within the resized VM left it temporarily unbootable. However, further testing with an unresized copy, along with the reports below, indicates that the boot issue is unrelated to the resizing routine: Software Update to install Tahoe 26.7 fails on a blank screen | Updating a 26.6.2 virtual machine to 26.7 just black screens on restart

❧ 2026-09-18

Fastmail: Forward a custom-domain alias to an external address

Settings → Users & Sharing → Aliases → + New alias → Show advanced preferences
Enter alias address
Under Deliver to, click x beside your address to remove it then enter the external address in its place → Add
Add an optional Description → Save

❧ 2026-09-17

At last! A macOS upgrade that feels like an upgrade

Finder: ~~Copied pathnames no longer wrapped in single quotes!~~ As before, pathnames with spaces get the single quote treatment, but the secret to disabling has been unlocked!
Safari: Create your own extension
Performance:
Interface:
- Inscrutable menu icons: gone!
- Expand/reveal hidden menu bar icons
Screenshot.app: Include System Audio option for screen recordings
Backups: Bootable copies live on in macOS Golden Gate — and they got better
Admin:
- macOS 27 changes how Macs are managed: binary control is in, PPPC is out
- Golden Gate's DeniedBinaries is all I ever wanted

As for iOS 27, alas, not a single item on my longstanding, humble wishlist has been fulfilled. If Apple takes privacy and security as seriously as its marketing suggests, it would do well to learn from GrapheneOS.

Disable the blue "Writing Assistance" popup: System Settings → Screen Time → Restrictions → turn on "Content & Privacy" → (optional: Siri → Siri: Don't Allow Siri) → disable "Writing Assistance" (and other unwanted Capabilities as desired)
Disable AI-generated reply suggestions in Messages: System Settings → Keyboard → Text Input → Input Sources → Edit… → All Input Sources → disable "Show suggested replies"
If Safari's active tab is too bright in dark mode, turn off "Reduce Transparency" in System Settings → Accessibility → Display.

❧ 2026-09-15

Resolving "SG_IO: bad/missing sense data" after running ATA SE on a WD My Passport USB HDD

USB storage bridges may expose ATA commands via SCSI/ATA Translation (SAT), but ATA Security behavior varies by bridge and firmware. Without an explicit vendor guarantee, reported capabilities alone do not confirm that a command can pass through the bridge and execute successfully on the drive.

To avoid orphaning data on the platters in the event of lockout, a 1 TB WD My Passport USB HDD was zeroed with dd then queried for ATA Security support:

hdparm -I /dev/sdX

/dev/sdX:

ATA device, with non-removable media
    Model Number:       WDC WD10JMVW-11AJGS1                    
...
Security: 
    Master password revision code = 48059
        supported
    not enabled
    not locked
    not frozen
    not expired: security count
        supported: enhanced erase
    332min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.
...

Setting a password appeared to work:

hdparm --user-master u --security-set-pass p /dev/sdX
security_password: "p"

/dev/sdX:
 Issuing SECURITY_SET_PASS command, password="p", user=user, mode=high

but issuing SECURITY ERASE failed:

hdparm --user-master u --security-erase p /dev/sdX
security_password: "p"

/dev/sdX:
 Issuing SECURITY_ERASE command, password="p", user=user
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Decoded SCSI sense data:

sg_decode_sense 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Fixed format, current; Sense key: Illegal Request
Additional sense: Invalid field in cdb

In other words, something in the storage path reported that the SCSI command descriptor block (cdb) used to carry the ATA request contained an invalid or unsupported field.

hdparm -I /dev/sdX initially continued to return the correct device information. However, after disconnecting and reconnecting the drive, it reported only:

/dev/sdX:

ATA device, with non-removable media
Standards:
    Likely used: 1
Configuration:
    Logical     max current
    cylinders   0   0
    heads       0   0
    sectors/track   0   0
    --
    Logical/Physical Sector size:           512 bytes
    device size with M = 1024*1024:           0 MBytes
    device size with M = 1000*1000:           0 MBytes 
    cache/buffer size  = unknown
Capabilities:
    IORDY not likely
    Cannot perform double-word IO
    R/W multiple sector transfer: not supported
    DMA: not supported
    PIO: pio0

Attempting to unlock also failed:

hdparm --user-master u --security-unlock p /dev/sdX
security_password: "p"

/dev/sdX:
 Issuing SECURITY_UNLOCK command, password="p", user=user
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

WD Drive Utilities restored access to the drive:

Launch WD Drive Utilities; the Unlock Drive prompt will appear:
The password set with hdparm will not be accepted; enter any password five times to reveal an erase option (the Drive Erase icon remains unavailable while the drive is locked):
Set volume name and format, acknowledge the warning, and click Erase Drive. The utility erases and reinitializes the drive, restoring access:

Updates

Restore access to the drive without leaving Linux by using the erase function in 0-duke's WD My Passport Drive Hardware Encryption Utility for Linux:

wdpassport-utils.py --device /dev/sdX
Device: /dev/sdX
Security status: Locked
Encryption type: Full Disk Encryption

Attempting to unlock the drive using the password set with hdparm fails, just as it does in WD's own utility:

wdpassport-utils.py --device /dev/sdX --unlock
[wdpassport] password for /dev/sdX: 
[!] Key hash parameters are not valid.

Erasing the drive, however, restores access:

wdpassport-utils.py --device /dev/sdX --erase
[+] All data on /dev/sdX will be lost. Are you sure you want to continue? [y/N]
y
[*] Device erased. You need to create a new partition on the device (Hint: fdisk and mkfs)

hdparm -I /dev/sdX

/dev/sdX:

ATA device, with non-removable media
    Model Number:       WDC WD10JMVW-11AJGS1                    
...
    device size with M = 1000*1000:     1000171 MBytes (1000 GB)
    cache/buffer size  = 8192 KBytes
    Nominal Media Rotation Rate: 5400
...

Inspired by tigerblue77's AI-generated, zero-dependency unlock and eject scripts (themselves inspired by Kenny MacDermid's wdpassport-utils), I asked Astra to build a similar script for erasing WD My Passport drives. It produced erase_wd_passport.py in one shot, using only the Python 3 standard library: no pip packages, sg3-utils, hdparm, pyudev, or compiled extensions required. Tested on the 1TB drive mentioned above; your mileage may vary. All existing data will be lost, and the drive itself may be rendered unusable. Proceed at your own risk (and joy).
#!/usr/bin/env python3 """Linux WD My Passport key reset; Python 3 standard library only. Protocol reference: https://github.com/0-duke/wdpassport-utils Replaces the encryption key, destroying access to ALL existing data. Does not perform ATA SECURITY ERASE, overwrite sectors, or format the disk. """ import argparse import ctypes as C import fcntl import os from pathlib import Path import stat import sys import time class SgIoHdr(C.Structure): # Linux include/scsi/sg.h, native ABI (do not pack). _fields_ = [ ('interface_id', C.c_int), ('dxfer_direction', C.c_int), ('cmd_len', C.c_ubyte), ('mx_sb_len', C.c_ubyte), ('iovec_count', C.c_ushort), ('dxfer_len', C.c_uint), ('dxferp', C.c_void_p), ('cmdp', C.c_void_p), ('sbp', C.c_void_p), ('timeout', C.c_uint), ('flags', C.c_uint), ('pack_id', C.c_int), ('usr_ptr', C.c_void_p), ('status', C.c_ubyte), ('masked_status', C.c_ubyte), ('msg_status', C.c_ubyte), ('sb_len_wr', C.c_ubyte), ('host_status', C.c_ushort), ('driver_status', C.c_ushort), ('resid', C.c_int), ('duration', C.c_uint), ('info', C.c_uint), ] STATES = {0: 'No lock', 1: 'Locked', 2: 'Unlocked', 6: 'Locked, unlock blocked', 7: 'No keys'} def scsi(fd, cdb, *, size=0, payload=None): writing = payload is not None length = len(payload) if writing else size data = C.create_string_buffer(payload, length) if writing else C.create_string_buffer(length) command = C.create_string_buffer(cdb, len(cdb)) sense = C.create_string_buffer(64) header = SgIoHdr(interface_id=ord('S'), dxfer_direction=-2 if writing else -3, cmd_len=len(cdb), mx_sb_len=64, dxfer_len=length, dxferp=C.addressof(data), cmdp=C.addressof(command), sbp=C.addressof(sense), timeout=60000) fcntl.ioctl(fd, 0x2285, header) # SG_IO if header.status or header.host_status or header.driver_status or header.info & 1: raise RuntimeError( f'SCSI failure: status=0x{header.status:02x}, ' f'host=0x{header.host_status:04x}, driver=0x{header.driver_status:04x}, ' f'sense={sense.raw[:header.sb_len_wr].hex(" ")}') if not 0 <= header.resid <= length or (writing and header.resid): raise RuntimeError(f'Unexpected transfer residual: {header.resid}') return data.raw[:length - header.resid] def get_status(fd): # Same allocation length and receive buffer as wdpassport-utils. data = scsi(fd, bytes.fromhex('c0 45 00 00 00 00 00 00 30 00'), size=512) if len(data) < 12 or data[0] != 0x45: raise RuntimeError('Short or invalid WD encryption-status response') return data[3], data[4], int.from_bytes(data[6:8], 'big'), data[8:12] def reset_command(status): state, cipher, key_length, token = status # Match upstream single-byte CDB length; refuse unsupported extensions. if state not in STATES or not 1 <= key_length <= 247 or len(token) != 4: raise RuntimeError('Unsupported WD status or key length; refusing reset') cdb = bytes([0xc1, 0xe3]) + token + bytes([0, 0, key_length + 8, 0]) payload = bytes([0x45, 0, 0, 0, cipher, 0, 0, 0]) + os.urandom(key_length) return cdb, payload def identify(device): dev = Path(device).resolve(strict=True) st = dev.stat() if not stat.S_ISBLK(st.st_mode): raise RuntimeError('Specify a whole block device, such as /dev/sdX') node = Path(f'/sys/dev/block/{os.major(st.st_rdev)}:{os.minor(st.st_rdev)}').resolve(strict=True) if (node / 'partition').exists(): raise RuntimeError('Partitions are not accepted; specify the whole disk') for parent in node.parents: if (parent / 'idVendor').exists(): vendor = (parent / 'idVendor').read_text().strip().lower() product = (parent / 'product').read_text().strip() if vendor != '1058' or 'passport' not in product.lower(): raise RuntimeError('Device is not identified as a WD My Passport USB drive') serial_path = parent / 'serial' serial = serial_path.read_text().strip() if serial_path.exists() else '(unavailable)' print(f'Device: {dev}\nUSB product: {product}\nUSB serial: {serial}') return str(dev), node, st.st_rdev raise RuntimeError('No USB identity found; refusing this device') def check_unused(node): nodes = [node] + [p for p in node.iterdir() if (p / 'partition').exists()] ids = {(p / 'dev').read_text().strip() for p in nodes} for p in nodes: if any((p / 'holders').iterdir()): raise RuntimeError(f'{p.name} is in use by another block device') for line in Path('/proc/self/mountinfo').read_text().splitlines(): if line.split()[2] in ids: raise RuntimeError('Drive or a partition is mounted; unmount it first') for line in Path('/proc/swaps').read_text().splitlines()[1:]: st = os.stat(line.split()[0]) if stat.S_ISBLK(st.st_mode) and f'{os.major(st.st_rdev)}:{os.minor(st.st_rdev)}' in ids: raise RuntimeError('Drive or partition is active swap; disable it first') def main(): parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('device', help='Whole WD My Passport disk, e.g. /dev/sdX') parser.add_argument('--erase', action='store_true', help='Destroy all data by resetting the key') args = parser.parse_args() device, node, devnum = identify(args.device) if args.erase: check_unused(node) # O_EXCL on Linux block devices also refuses mounted/claimed devices. flags = os.O_RDWR | os.O_NONBLOCK | (os.O_EXCL if args.erase else 0) fd = os.open(device, flags) try: if os.fstat(fd).st_rdev != devnum: raise RuntimeError('Device changed while opening it') current = get_status(fd) print(f'Security: {STATES.get(current[0], "Unknown")} (0x{current[0]:02x})\n' f'Cipher: 0x{current[1]:02x}; key length: {current[2]} bytes') if not args.erase: return phrase = f'ERASE {device}' print('ALL data on this disk will become inaccessible. Keep it connected.') if input(f'Type {phrase!r} to continue: ').strip() != phrase: print('Cancelled.') return check_unused(node) # The reset token changes: fetch it immediately before sending E3. command, payload = reset_command(get_status(fd)) print('Sending WD key reset...', flush=True) try: scsi(fd, command, payload=payload) except (OSError, RuntimeError) as error: raise RuntimeError(f'Reset outcome uncertain; do not automatically retry. {error}') from error print('WD key-reset command completed successfully.') time.sleep(2) try: after = get_status(fd) print(f'After reset: {STATES.get(after[0], "Unknown")} (0x{after[0]:02x})') if after[0] not in (0, 2): raise RuntimeError('Post-reset access is not confirmed') capacity = scsi(fd, bytes.fromhex('25 00 00 00 00 00 00 00 00 00'), size=8) if len(capacity) != 8 or int.from_bytes(capacity[:4], 'big') == 0xffffffff: raise RuntimeError('Capacity could not be verified with READ CAPACITY(10)') sectors = int.from_bytes(capacity[:4], 'big') + 1 sector_size = int.from_bytes(capacity[4:], 'big') if not sector_size: raise RuntimeError('Device reported zero sector size') print(f'Reported capacity: {sectors * sector_size:,} bytes') sector = scsi(fd, bytes.fromhex('28 00 00 00 00 00 00 00 01 00'), size=sector_size) if len(sector) != sector_size: raise RuntimeError('Short first-sector read') print('First sector is readable.') except (OSError, RuntimeError) as error: raise RuntimeError(f'Reset completed, but verification failed: {error}. ' 'Reconnect and run status-only; do not repeat erase blindly.') from error try: fcntl.ioctl(fd, 0x125f) # BLKRRPART except OSError as error: print(f'Partition rescan failed ({error}); reconnect the drive.') print('Create a new partition table and filesystem before use.') finally: os.close(fd) if __name__ == '__main__': try: main() except (OSError, RuntimeError, EOFError) as error: print(f'Error: {error}', file=sys.stderr) sys.exit(1) except KeyboardInterrupt: print('\nInterrupted. If reset was sent, check status before trying again.', file=sys.stderr) sys.exit(130)
Usage

Without --erase, the script only queries WD encryption status:
```
python3 erase_wd_passport.py /dev/sdX
Device: /dev/sdX
USB product: My Passport 07A8
USB serial: XXXXXXXXXXXXXXXXXXXXXXXX
Security: Locked (0x01)
Cipher: 0x30; key length: 32 bytes
```
To erase, unmount any mounted filesystems on the disk, then run:
```
python3 erase_wd_passport.py /dev/sdX --erase
Device: /dev/sdX
USB product: My Passport 07A8
USB serial: XXXXXXXXXXXXXXXXXXXXXXXX
Security: Locked (0x01)
Cipher: 0x30; key length: 32 bytes
ALL data on this disk will become inaccessible. Keep it connected.
Type 'ERASE /dev/sdX' to continue: ERASE /dev/sdX
Sending WD key reset...
WD key-reset command completed successfully.
After reset: No lock (0x00)
Reported capacity: 1,000,170,586,112 bytes
First sector is readable.
Create a new partition table and filesystem before use.
```
What it does

The script implements the WD encryption-key reset from 0-duke/wdpassport-utils using standard-library ctypes and fcntl.ioctl. Before resetting, it verifies the whole-disk path and WD My Passport USB identity, checks for mounts, swap, and block-device holders, opens the device exclusively, and requires explicit confirmation. It then queries the drive's encryption status and current reset token and sends WD's vendor-specific key-reset command (C1 E3), intended to replace the internal data-encryption key and make existing data inaccessible. The request includes random bytes, following upstream's implementation, but whether the firmware uses them is unverified. Afterward, the script checks security status, capacity, and first-sector readability, then requests a partition rescan. These checks confirm basic access, not secure sanitization: the operation does not overwrite user-data sectors, create a filesystem, or perform ATA SECURITY ERASE. Firmware support varies, and this is not a general fix for "SG_IO: bad/missing sense data" errors.

❧ 2026-09-12

Easy Disk Checker: diagnostics, imaging, and data recovery

8 months ago, u/Routine_Eye3806 announced Easy Disk Checker for Windows on r/datarecoverysoftware:

[Dev] I created Easy Disk Checker - a free Windows utility to check HDD\SSD health and detect fake USB drives with some data recovery options (No Ads)

and it has been receiving regular updates since:

Current highlights include:

Drive diagnostics: SMART attributes, Seagate FARM logs, HPA and ATA password detection, and identification of the underlying drive behind USB bridges.
Flash identification and testing: USB controller details, NAND IDs via controller-specific commands, fake-capacity detection, and surface scans for bad sectors.
Imaging and cloning: Raw sector images, dynamic VHD/VHDX images, partition images, disk-to-disk cloning, and file extraction from images.
Filesystem and partition recovery: MBR/GPT recovery and file browsing/copying across FAT, exFAT, NTFS, Ext2/3/4, HFS+, APFS, and BTRFS.
RAID and DVR recovery: Automatic reconstruction of striped, mirrored, RAID-5, and RAID-6 arrays from disks or images, plus searches for DVR recordings.
Low-level tools: Sector hex viewing/editing and, in version 6.0, microcode patching intended to restore file access on supported failed SSDs, starting with Phison-based models.
Beyond storage: Reading and repairing errors in DDR4 and DDR5 memory SPD dumps.

In the last update, I asked u/Routine_Eye3806 if he had shared Easy Disk Checker on HDDGURU, to which he replied that he hadn't but would appreciate me sharing it there. My submission has not received moderator approval after 2 days, so I am posting it here instead.

Additional links:

❧ 2026-09-11

Create a reference Windows 11 IoT Enterprise LTSC eval VM in UTM

Download Windows 11 IoT Enterprise LTSC evaluation (ARM64 | x64) and utm-guest-tools-latest.iso.
Create the VM with "Install drivers and SPICE tools" unchecked (otherwise, clicking "I don't have a product key" during setup will fail with "Setup has failed to validate the product key").
Disconnect from the network, then install Windows.
Install UTM Guest Tools: Virtual Machine → Drives → CD/DVD…iso → Change → select utm-guest-tools-latest.iso → run D:\utm-guest-tools-0.1.271.exe. Eject when done.
Customize Windows as desired (taskbar, desktop background, dark mode, File Explorer, Edge, etc.), shut down, and save as your reference image.
Reconnect to the network, clone the reference VM, and boot the clone.
Windows should activate automatically and the desktop watermark change from "Windows License is expired" to "Windows License valid for 90 days". If not, run cscript //nologo %windir%\system32\slmgr.vbs /ato and reboot. If activation fails due to no network connectivity, try setting a public DNS server or switching from Shared Network to Bridged (Advanced).

❧ 2026-09-07

macOS native window management à la Rectangle

After years of happy Rectangle and Spectacle use, had missed that native window tiling was added in macOS Sequoia: Settings → Keyboard → Keyboard Shortcuts… → Windows.

Default keyboard shortcuts:

Shortcut	Action
Fn+Ctrl+←	Tile left half
Fn+Ctrl+→	Tile right half
Fn+Ctrl+↑	Tile top half
Fn+Ctrl+↓	Tile bottom half
Fn+Ctrl+F	Fill (classic full screen)
Cmd+Ctrl+F	Full screen

❧ 2026-09-07

Safely shut down during OOBE in Windows, macOS, and Linux Mint

These out-of-box experiences (OOBE) offer no obvious shutdown option, but each can still be powered off gracefully:

Windows: Shift+F10 → shutdown /s /t 0
macOS: Cmd+Q → Shut Down
Linux Mint (first boot after an OEM install): Ctrl+Alt+F2 → once the text console appears, quickly press and release the power button to shut down safely. GRUB may appear on next boot; one complete startup clears recordfail and re-hides the menu.

❧ 2026-09-05

Wandering the well-worn sidepaths to nowhere

"In one particular the civilized man still is brother to the savage: His thoughts seldom rise above the dust of which he is made."

—Robert Quillen, "When Guests Saw Only the Parlor, There Was Trash in the Closets", The State, October 22, 1929, p. 4.

❧ 2026-08-19