Getting more from Recovery on Apple silicon Macs

Whether you’ve become familiar with the basics in Recovery mode on Apple silicon Macs, or you just need deeper information, this article is intended to supplement my illustrated guide.

Which Recovery mode?

Unless your Mac has two or more systems installed, there are only two Recovery modes:

Paired Recovery, the default, run from a mounted disk image stored in the Recovery volume in the active boot volume group;
Fallback Recovery, engaged using a short press, then a held press of the Power button, in a ‘di-dah’ rhythm. This isn’t always available, but when it is it runs from a dedicated partition/container on the internal SSD. Although it can do everything else, you can’t use its Startup Security Utility, which is only available in paired Recovery.

This is a bit more complicated when your Mac has more than one bootable system available. The rule then is that it will enter paired Recovery for the current boot volume group. If you have Sonoma and Sequoia installed and want to do anything with the Sonoma boot volume group, then you should make Sonoma the active Startup Disk, and ideally restart into that, before shutting down to start up in Recovery mode. Although the initial Options screen allows you to choose boot volume groups, that procedure ensures that you’ll always use the correct tools for the job.

Change keyboard

Throughout Recovery mode, you can change the default keyboard, which is set to that in NVRAM. At the top right, the keyboard menu offers those standard in macOS. If you’re experiencing problems entering your password, check that you’re using the right keyboard here.

Installer Log

This is useful for the checks that it reports, including statements that the network is reachable, and details of the current user, whether they have admin privileges, and have a secure token to be able to unlock FileVault. If you need to get into the weeds, its popup menu can be set to Show All Logs, and you might even be able to save the log to somewhere that’s accessible when back in normal user mode.

Utilities: Share Disk…

This menu command is used to put that Mac into the modern equivalent of Target Disk mode. That requires it to be connected to another Mac using a Thunderbolt or USB data cable, and will then mount its Data volume on that Mac, connected using SMB over the cable. Although not as fast as a direct Thunderbolt connection, it’s valuable if you need to retrieve files from a Mac that can’t boot in normal user mode.

Utilities: Terminal

This opens a bash shell rather than the zsh we’re now used to, as root user. There are a great many useful tools included in the Recovery System, including: fsck, fsck_apfs, mount, mount_apfs, csrutil, asr, nvram, spctl, sysctl, and /usr/bin and /usr/sbin contain many more. The biggest snag with them is that, in 15.3.1 at least, there’s no man command, although many will show their standard usage information with an -h option.

One command tool peculiar to Recovery mode is its equivalent to sysdiagnose, recoverydiagnose, in case you need to file a bug report about Recovery mode.

There’s also repairHomePermissions, which launches a GUI app to repair permissions on a selected Home folder on the Data volume. I strongly recommend that you don’t try using this, as you’ll end up with the user being locked out of every folder in their Home folder. This appears to be a historical remnant that has somehow been left behind, long after it outlived its usefulness.

Utilities: Startup Security Utility

I have already explained at length how to use this to change boot security, in conjunction with adjusting SIP, and more, in this article.

Main Window: Disk Utility

Although Disk Utility invariably opens with its default settings, the version supplied in Recovery is every bit as capable as that in normal user mode. Once it has opened, set its View tool to Show All Devices, and if you want to work with snapshots, set its View menu to Show APFS Snapshots.

Main Window: Safari

As with Disk Utility, the version of Safari provided is almost as fully equipped as normal, and apparently runs from a cryptex. It opens with a local page that explains features in Recovery mode, but you can access Google search engine and pretty well anything else you want, including articles in this blog.