The Silent Diagnostic Engine
When a severe hardware failure occurs on a Mac—for instance, if the Wi-Fi card suddenly drops off the PCIe bus, or if the GPU experiences a kernel panic during a heavy rendering task—macOS does not just instantly reboot and ignore the problem. The operating system utilizes a low-level diagnostic daemon called CoreCapture.
The CoreCaptureDaemon sits just above the kernel. When a hardware fault is detected, this daemon intercepts the panic, freezes the system state for a fraction of a second, and rapidly dumps the raw firmware logs, PCIe register states, and baseband telemetry into a massive diagnostic archive (often generating a .corecapture or .tar.gz file) before allowing the Mac to restart. These files are designed to be sent to Apple Engineering for deep hardware analysis.
However, if a specific hardware component (like a failing Bluetooth module or a glitchy USB-C hub) is generating hundreds of micro-faults per hour, the CoreCapture daemon will become hyperactive. It will constantly intercept the faults, spinning the CPU to 100% and aggressively writing gigabytes of diagnostic data to the SSD. The user will experience severe system lag, rapidly depleting battery life, and a massive loss of hard drive space. To stop this diagnostic loop, you must forcefully purge the CoreCapture cache via the Terminal.
Locating the CoreCapture Caches
Because these files contain raw kernel memory dumps (which might include passwords or encryption keys that were in RAM at the time of the crash), they are stored in a highly restricted, root-only directory:
/Library/Logs/CrashReporter/CoreCapture/
You cannot simply open Finder and drag these files to the Trash. You must use elevated UNIX commands.
Purging the Cache via Terminal
You must use the Terminal with elevated (sudo) privileges to aggressively delete the cache and safely restart the daemon.
- Open the Terminal application.
- First, forcefully terminate the
CoreCaptureDaemonprocess. This will immediately stop the runaway CPU usage and release the file locks on the diagnostic dumps:
sudo killall CoreCaptureDaemon
sudo killall corecaptured(Note: Depending on your exact macOS version, the process name might vary slightly, so issuing both commands ensures termination).
Press Enter, type your Mac’s administrator password (the characters will remain invisible), and press Enter again.
- Next, navigate into the restricted logging directory and obliterate the massive archive files. The
-rfflag forces recursive deletion without asking for confirmation:
sudo rm -rf /Library/Logs/CrashReporter/CoreCapture/*- (Optional but recommended): Delete the daemon’s local preference state to ensure it resets to factory defaults:
sudo rm -f /Library/Preferences/com.apple.corecapture.plistThe Recovery Process
The moment you executed the killall commands, the macOS launchd subsystem detected that a critical system daemon had died and immediately respawned a fresh, uncorrupted instance of CoreCaptureDaemon in the background.
The new daemon will initialize against an empty /CoreCapture/ directory and a clean preference state. The CPU usage will instantly drop back to normal baseline levels (typically 0.1%), and you will have successfully reclaimed gigabytes of wasted SSD space.
Note: While this fixes the software loop and reclaims the CPU, if the underlying hardware (e.g., the Wi-Fi card) is actually failing, the daemon will eventually start generating crash logs again when the hardware inevitably faults. If the folder fills up again within 24 hours, you have definitive proof of a physical hardware failure requiring replacement.