46

I just had a window pop up telling me it was Opening BaseSystem.dmg, and then disappearing in ~1 second. All I can find is a reddit thread with preciously few answer. Anybody with more intel? I was doing a backup (with Time Machine, an USB connected external drive) when the pop up flickered.

I am on MacOS 10.13.6 (17G65).

EDIT: the same dialogue just flashed up (I am doing a backup, with an external HD connected with a USB port). So likely this popup has something to do with having a drive attached.

user1256923
  • 3,610
  • 1
    You stated, "I was doing a backup when the pop up flickered.", well it might be more helpful if you gave some details surrounding this. What type of backup, Time Machine, to a disk directly attached or over the network, or if not Time Machine what, etc. – user3439894 Aug 01 '18 at 15:41
  • See this answer on Apple Discussons: I don't think there is too much to be worried about. That sounds like the Gatekeeper dialog. If you try to access newly downloaded file, Gatekeeper does a security check. Normally, that is instantaneous. But in some cases, the file is very large and/or your hard drive is very slow. Then, you might get the dialog. An Xcode download, for example, always displays that dialog, even on an SSD drive. – IconDaemon Aug 01 '18 at 16:51
  • @user3439894, a Time Machine backup. – user1256923 Aug 01 '18 at 22:56
  • @IconDaemon I do not remember opening or downloading any file at the time the dialog came up – user1256923 Aug 01 '18 at 22:58
  • sensorstechforum.com/remove-basesystem-dmg-virus/ is another result that shows up when searching for "BaseSystem.dmg". The page talks about a virus but it looks very much like scaremongering to get you to buy into their (probably subpar) software. – the Aug 09 '19 at 21:36

3 Answers3

16

I have also seen this happen on my system a few times. For me, it happens right when a Time Machine backup finishes (I am also backing up to an external USB HD). I am running macOS Mojave 10.14.3 (18D42).

It is very likely that Time Machine creates this file so that it can recover the OS in the case that the backup fails and screws up your system. It probably self-deletes this file if there are no issues at the conclusion of the backup.

In case Time Machine is not the only culprit, I recommend searching your system for the source(s) of the file. Open the application "Terminal", and run the following command:

sudo find / -name BaseSystem.dmg -type f 2>/dev/null

This will prompt you for your admin password because it will search all files on your system (even those owned by the root user). Depending on how big your hard drive is, this could take a very long time.

For me, the only file found was at /Library/Application Support/com.bombich.ccc/Recovery/BaseSystem.dmg. This is a directory used by Bombich Software's Carbon Copy Cloner application. I know this application archives the recovery partition for your OS (so you can reinstall macOS if needed), so I am assuming this DMG file is related to that.

I haven't tried it, but I assume that if I were to delete this CCC file, it would just get recreated by CCC later. As others have stated, this file does not seem to be malicious or harmful in any way, so keeping it around or deleting it probably doesn't matter too much and is really up to you.

If you really want to, you can delete all of these files with the following command:

sudo find / -name BaseSystem.dmg -type f -delete -print

Mattman
  • 161
11

BaseSystem.dmg usually contains a MacOS installer.

The dialog you experience has been reported by many after upgrading to 10.13. It seems to be new functionality in 10.13 that is opening these DMGs for some (unknown) reason.

You probably want to check if your Time Machine drive or the backup bundle inside it has a BaseSystem.dmg file. MacOS is then automatically opening that file to check for something (unknown purpose).

It doesn't appear to be in any way harmful nor malicious.

jksoegaard
  • 77,783
-3

We check the identifier of the volume

diskutil list |grep "Recovery"

4:                APFS Volume ⁨Recovery⁩                613.8 MB   disk2s3

Now let's make the volume writable

diskutil mountDisk  /dev/disk2s3

The terminal will now forward us

open -R /Volumes/Recovery
BabyBoy
  • 925
  • If the OP gets a message about BaseSystem.dmg getting opened, why is mounting of a disk required afterwards to see the file? Also, what do you commands to, what is the result, how does it answer the question? Please edit the answer to add details. – nohillside Apr 27 '21 at 07:00