If the room you’re in suddenly went dark and filled with smoke, would you be able to get to the fire escape? That was the question put to me many years ago by a friend who, like me, often stayed overnight in unfamiliar locations. I think he took it to extremes, though, in travelling everywhere with a thirty-foot climbing rope in his suitcase, but his point was sound. A few years later, when I was stood outside a hotel after a fire alarm in the late evening, I was glad to have taken that advice.

Much of what we do on our Macs can be at worst relatively harmless, and there are simple measures we should take to ensure they’re safe. Accidentally delete the wrong files, and you should be able to restore them swiftly from your latest backup. Cut out a crucial section of a document, and you should be able to look back through its saved versions and paste the text back from one of those. That’s why we have all those checks and safeguards.

Every so often, though, we do something that could have greater consequences, like adding another volume to our boot disk, or installing an alternative operating system such as Asahi Linux. Those are the times we need to check where the fire escape is.

If anything goes wrong with the containers and volumes on the internal storage of an Apple silicon Mac, the result can be serious, because these Macs have to start their boot process from there.

Intel Macs, including those with T2 chips, can of course start up entirely from an external disk. Although that might appear advantageous, in the long run it’s not as good as it might seem. Those with the added boot security that comes with a T2 can only boot from an external disk when that has been specifically enabled in Startup Security Utility, in Recovery mode, and the time to think about that isn’t when it can’t boot from its internal SSD.

Unlike Apple silicon Macs, though, Intel Macs with T2 chips can’t boot from an external disk in full security. In practice it means that, if you do enable that, anyone can attach any bootable disk to your Mac, start it up from that, and make off with it. So making the decision whether to enable your T2 Mac to start up from external disks will either compromise its security or its recoverability.

There’s no compromise of security when booting an Apple silicon Mac from an external disk, as that can only happen when that disk has a LocalPolicy created for it, that in turn requires ownership, and secure controls from the internal SSD. But if the internal SSD has become messed up, that Mac may well not get as far as considering starting up from the external disk, and all you can hope for is that it will be able to enter Recovery or Fallback Recovery.

If this all seems more complex and fiddly in Apple silicon, in practice it’s not, as boot failure is far less likely, and in most cases can be managed fully in either Recovery mode. However, making changes to the layout of containers and volumes on the internal SSD is one situation where an Apple silicon Mac’s ability to boot can be compromised. The Asahi Linux Project has drawn attention to one mistake that can spell disaster, removal of the Apple_APFS_Recovery partition/container from the internal SSD.

Let’s assume that you’ve changed partitions/containers and/or volumes on your Apple silicon Mac’s internal SSD, and want to revert to its original layout. You now have a choice of attempting that in either Recovery mode, using the diskutil command tool there, or putting your Mac into DFU mode and performing a full Restore with the IPSW image file for the macOS version of your choice.

Provided you have a second Mac and USB-C cable to connect it, and a recent full backup available to migrate from, Restore in DFU mode is likely to prove the simpler and more reliable option. Unless, that is, you’re the kind of person who also likes hoisting out your car engine and disassembling it on your kitchen table.

For all its apparent complexity, this is where an Apple silicon Mac comes into its own, as you can now Restore it to Sequoia even though Apple still so earnestly wants you to savour the delights of Tahoe’s Liquid Glass.

Follow my friend’s advice. When you’re about to do something that could have serious consequences, check where the fire escape is, as one day you may well have to rely on it.

When Apple introduced the first iPhone it built into its ROM a new startup mode that didn’t rely on other firmware, to enable recovery of a bricked or troubled device: Device Firmware Upgrade, or DFU, mode. This was added to Intel Macs with the introduction of the T2 chip, and is a fundamental feature of all Apple silicon Macs. If your Mac’s hardware is still capable of booting from its ROM, and it supports DFU mode, it may well enable that Mac to be rescued from disaster.

All Macs start up from their ROM initially, and that provides essential services to support the boot process, from checking the integrity of the next stage, the low-level bootloader, to handing over to that. Boot ROMs in Macs with T2 or Apple silicon chips can also be parked in DFU mode, which stops the rest of secure boot from continuing, and waits indefinitely for a connection over a USB port. Another Mac can then connect with the Mac in DFU mode, and can install fresh firmware, or completely initialise the SSD, to resuscitate the Mac in DFU mode.

What you need

To use DFU mode, you require:

• the target Mac in DFU mode, as detailed below;
• a second Mac, the host, either running macOS Sonoma or later, or the current version of Apple Configurator 2 from the App Store;
• a plain USB cable with a USB-C plug at each end. This should support both charging and data over USB. Although Apple has consistently warned that you shouldn’t use a regular Thunderbolt 3 cable, some claim to have got them to work correctly.

If you don’t have all three, you should find your nearest Apple store will help, as will Apple authorised service providers.

DFU host

Prepare the second Mac, that’s going to connect to the target Mac in DFU mode, as follows:

• If it’s a laptop model, connect it to mains power.
• Ensure it has a good internet connection.
• If it’s not using Configurator, open Finder Settings and ensure CDs, DVDs and iOS Devices is selected to be shown in Finder window sidebars, as that may be necessary to see the target Mac when it connects.
• Connect one end of the USB cable to any of its USB-C ports.

Put a Mac into DFU mode

Prepare the target Mac that’s going to be put into DFU mode to be resuscitated, as follows:

• Disconnect all non-essential peripherals, particularly any connecting to its USB-C ports.
• Ensure its DFU port is available, and connect the other end of the USB cable to that port.
• If it’s a laptop model, connect it to mains power. If it has a MagSafe port, use that if possible.
• If it’s running, shut it down. If you don’t know whether it’s shut down, press and hold the Power button to shut it down. If that starts it up, repeat that to shut it down again.

Apple’s official list of DFU ports is here. You’ll also find them listed in MacTracker. Unfortunately, there’s no simple rule, neither does Apple mark the port.

If the Mac is a laptop model, having ensured it’s connected to mains power and shut down, press the Power button briefly as if to start it up normally, then immediately press and hold Control and Option on the left of its keyboard, Shift on the right, and the Power button, all at once. Keep pressing all four keys for 10 seconds, then release Control, Option and Shift, and continue holding the Power button for another 10 seconds, until the host Mac shows the DFU window. If you’re shown an alert asking for consent to connect the accessory, release the Power button and click the Allow button.

Laptops with a T2 chip should display the DFU window on the host after holding the four keys for a shorter period of about 3 seconds, and don’t require the full process needed for an Apple silicon Mac.

If the Mac is a desktop model, having ensured that it’s shut down, disconnect the target Mac from mains power by unplugging its power cable, then press and hold its Power button and connect the Mac to mains power again. You may then need to continue holding its Power button for up to 10 seconds before you see the DFU window on the host Mac, and can release that button. If you’re shown an alert asking for consent to connect the accessory, release the Power button and click the Allow button.

Although putting a Mac into DFU mode isn’t really that difficult, lack of feedback from the target Mac makes this seem challenging. In DFU mode, a laptop Mac appears completely dead, and even mains adaptors don’t light up to provide any sign of life. Desktop models are more helpful, as the power status light on Mac Studio, Mac mini and Mac Pro models should show amber, and may even flash.

Revive or Restore?

The DFU window on the host Mac offers two options, to Revive or Restore the target Mac in DFU mode.

When reviving, the firmware on the target Mac is reinstalled without erasing the rest of its SSD. Unless you intend to perform a full Restore, this should normally be your first choice. It’s also significantly quicker.

The default version of firmware and macOS used for these is the latest compatible with that Mac. For Apple silicon Macs, you can instead download a different IPSW image file to use, if you prefer. This enables you to perform a full downgrade to an earlier version of macOS complete with its firmware. Links to Apple’s library of IPSW files are provided by Mr. Macintosh, and others. However, this isn’t available for Macs with T2 chips, which can only install the current firmware for that model.

A full Restore not only reinstalls the firmware, but it also erases the SSD completely and returns it to ‘factory’ condition, as it was when it was first unboxed. This erases all your data, as well as reinstalling firmware and macOS, so you will then need to migrate your data from a backup, which makes it considerably longer to complete.

Following either of these, the target Mac should restart into Recovery mode, back into macOS, or into initial personalisation and configuration as if it was new. If a Revive fails, try a full Restore, and if that fails, you might be successful with a second attempt, or you’ll need to get your Mac assessed at an Apple store, or by an Apple authorised service provider.

Key points

• Use a USB cable, not Thunderbolt 3.
• Check and use the correct DFU port on the Mac in DFU mode.
• Laptops: left Control and Option, right Shift, and Power for 10 seconds, then Power alone for up to 10 seconds.
• Desktops: disconnect from power, press and hold Power button and reconnect power cable, continue holding Power button for up to 10 seconds.
• Try Revive first.
• Apple’s support note.

I wish you success!

Macs are well known for their longevity, and are substantially cheaper when purchased used. This is a good time to consider buying a used Mac, as prices for Intel models are continuing to fall, and earlier Apple silicon models are becoming more widely available. However, buying any used computer is higher risk than buying new. This article explains how to reduce that risk.

Official refurbs

If you’re looking for discounted recent models, then the best place is Apple’s refurb store, in your local version of this page. These should be effectively as new, and include relatively recent models, but you’re unlikely to make big savings here. They’re ideal if you enjoy unboxing, as refurbs ship in their standard packaging.

Resellers

Most countries have retailers who specialise in preparing and selling used Macs. Among the best known are:

• MacSales, part of OWC, covering USA and Canada
• Hoxton Macs, in the UK
• MacFinder, in the UK.

These are staffed by Apple-trained technicians who check each Mac thoroughly. They offer a wider range of models, many of them at highly affordable prices. Most offer a return period, as well as a one-year warranty, and are subject to local consumer protection law.

Private vendors

My one and only golden rule is never to buy a used Mac without seeing it in the flesh beforehand. That bargain a thousand miles away could turn out to have been stolen, and even if it’s genuine you could still end up with a useless Mac. I’ve never heard of anyone buying a house or car without seeing it for themselves, and a Mac should be no different. I suppose it’s feasible to go through the following checks over FaceTime or Zoom, but there are so many skilled con artists around I wouldn’t risk it.

When you arrive and see the Mac you’re about to purchase, work systematically through the following.

Provenance

Your first and most important question is whether this Mac is the seller’s to start with. The best answer comes in the form of its original proof of purchase, giving its serial number. Check that matches the serial number in Hardware Overview in System Information. If it doesn’t, then thank them politely and leave as quickly as you can. While you’re looking in that section, if the Mac has a T2 or Apple silicon chip, at the foot of that information you’ll see its Activation Lock Status: if that’s enabled, make a careful note, as you’ll need to get that disabled before you take your new Mac away. Intel Macs without T2 chips don’t have that to worry about.

Establishing provenance gets more complicated if that Mac has had more than one previous owner, but the current owner should ideally have a chain of bills of sale to reassure you. If they don’t, then that Mac may well have a murky past that could catch up with you.

Condition

Once you have confidence that you’re dealing with the real owner of the Mac, check it out as thoroughly as you can, without rushing or stripping it down to its logic board. A careful and undistracted visual examination is important, and gives clues through its general cleanliness as to how well it has been cared for.

It would be comforting to run hardware diagnostics just in case, although that’s not a particularly sensitive check for incipient problems. In ideal circumstances you’d want to check wear and any errors on its internal SSD using DriveDx or another SMART utility, but you’re unlikely to get the chance. If you have a friend who is a hardware technician, they could be a real boon to take along, just as you should take a good mechanic when you check out a used car.

AppleCare

If the current owner has AppleCare cover on that Mac, they should in most cases be able to transfer that with its sale. This requires them to sign into My Support for the agreement number and details, and with the original sales receipt for that Mac, to contact Apple Support and give them your details as the new owner. Apple explains this here, with useful onward links.

Haggle

I wish you success in agreeing the best price.

Activation Lock (Intel T2, Apple silicon)

The last hurdle in a successful purchase is the one most often forgotten, and the cause of much buyer remorse. It’s all the fault of Activation Lock and Find My Mac. These ensure that the owner’s Apple ID and password are required before that Mac can be used, erased, or Find My Mac disabled. In effect they make that Mac useless to anyone else until Activation Lock has been disabled.

Macs with T2 or Apple silicon chips running Catalina or later, where the user has 2FA on their Apple ID, are likely to be protected by Activation Lock. There is an additional requirement, depending on their architecture:

• Apple silicon Macs must have their security policy set to Full Security;
• Intel T2 Macs must have startup security set to Secure Boot, with booting from external drives disallowed.

Activation Lock is most commonly enabled when Find My Mac is turned on, and turning that off also disables Activation Lock. That requires entry of the current user’s Apple ID password, so must be done by the seller before they part with their Mac.

There are other ways to disable it:

• It’s automatically disabled when the owner runs Erase All Content and Settings, only available on T2 and Apple silicon models anyway.
• Activation lock can be disabled in the owner’s account at www[.]iCloud[.]com/find by removing that Mac from the list of All Devices there.
• If you have proof of purchase, you can request Activation Lock to be removed by Apple support, but that’s a last measure and not something you should ever choose.

Apple’s guidance is here.

Never take possession of someone else’s Mac while its Activation Lock is active, as it will only cause you trouble and grief.

Handover

If everything is going well, you should be ready for the Mac to be handed over to your possession, accompanied by a written record of the sale. The conclusion is best seen as a mutual arrangement, as it gives the seller confidence that any data on that Mac is completely erased, and you the confidence that you’re about to gain a Mac you can use.

If it’s an Intel Mac, confirm with one another that it starts up without requiring a firmware password. If it has a T2 or Apple silicon chip, use its Erase All Content and Settings together to ensure that all its old files are made unreadable, and to be certain that Find My Mac and Activation Lock are disabled. Sadly, erasing older Intel Macs without T2 chips is a slower and more complicated process.

Checklist

• Inspect the Mac before handing over any money.
• Check proof of purchase and serial number, noting Activation Lock status.
• Visual examination, check SSD health if possible.
• Agree the price.
• Transfer AppleCare if available.
• Disable Activation Lock (in EACAS if available).
• Obtain written record of sale.
• Ensure no firmware password (Intel only).
• Erase, preferably using EACAS where available.