Reading view

There are new articles available, click to refresh the page.

Recover files from a sick Mac

Gone are the days when you could pop the hard drive out of a sick Mac and connect it to another to recover its contents. This article explains how you may be able to transfer some or all of the contents of a modern Mac’s internal SSD to another Mac.

Any Mac: Thunderbolt

As long as you can get your Mac up and running, the fastest way to transfer files from its internal storage is back-to-back Thunderbolt networking, easily set up in Network settings. All you need is another Mac with a free Thunderbolt port and a suitable cable to connect them directly.

Apple silicon: Share Disk

If you can get an Apple silicon Mac to start up in Recovery mode, or Fallback Recovery, then you’ve got a good chance of salvaging whatever you need from its internal SSD.

Connect it back-to-back with another Mac using a Thunderbolt 4 (or 3) cable. Start the sick Mac up in Recovery, pass through to Options and authenticate as necessary. In the Utilities menu there select the Share Disk command.

Select the volume you want to share, and when necessary unlock it with the password required for its encryption.

On the other Mac, that shared volume should appear as a networked device, connected as Guest, or on the Desktop. Despite that, you should have full access to its contents. This connection uses SMB, so listing large folders in the Finder will be surprisingly slow.

Now you can copy across all the files you want to your other Mac. That’s impressively quick, and can read them at about 3 GB/s, as you’d expect from a fast locally attached SSD. However, because of the SMB overhead, copying many small files is noticeably slower.

This can also get a bit kludgy when you’ve finished and want to disconnect. Trying to eject the shared volume may not work, and even when you stop sharing on the Mac in Recovery, and disconnect the cable, you may find the other Mac just won’t let go of it.

This only works with a single volume at a time. If you have added volumes to your Mac’s internal SSD, then you’ll have to repeat the process to access files on a different volume. But it does allow you to choose which volume to share.

Apple silicon: DFU mode

If you’re unable to put your sick Mac into Recovery, or Fallback Recovery, it’s still possible it has entered DFU mode, or could do so when started up to engage that mode. This is explored in more detail in this article, but doesn’t give you access to the contents of the Mac’s internal storage. You could try reviving it rather than performing a full Restore, though, as that isn’t destructive of its contents.

Intel T2: Target Disk

There are now two ways to enter Target Disk Mode on an Intel Mac with a T2 chip: if the Mac is already up and running (and not near-dead at all), you can opt for this in System Settings > General > Startup Disk, although I’m not sure why you would want to. If the Target really is sick, the only way you’re likely to engage this mode is to hold the T key during startup until the Thunderbolt symbol appears on its display.

The Target and Host must now be connected using a Thunderbolt 3 or 4 cable, although between Macs that are both running Catalina or earlier, a USB or USB-C cable could be used instead.

Shortly after they’re connected and ready, the Target’s internal Data volume should mount in the Host’s Finder. You should then be prompted for its FileVault password, and gain access to its contents. As with Apple silicon Macs, you can also copy files from the Host to the Target. To disconnect the Host and Target, eject the Target’s volume from the Host, then press and hold the Power button on the Target to shut it down.

Note that Target Disk Mode doesn’t offer a choice of volume.

Any Mac: External Boot Disk

If an Intel Mac with a T2 chip already has its boot security set (using Startup Security Utility) to allow it boot from an external disk, you may be able to get that to work, then mount the internal SSD to allow you to recover its contents to that or another external disk.

This is unlikely to work with an Apple silicon Mac, though, as it must always start the boot process from its internal SSD before it can continue booting from a system installed on an external bootable disk.

Summary

  • Cable: Thunderbolt 4 (or 3) connecting the two Macs back-to-back.
  • Apple silicon Mac: Recovery mode, Utilities menu, Share Disk.
  • Intel T2 Mac: T key held during startup.
  • Eject the Target’s disk on completion.
  • Apple silicon Mac: disconnect button, then shut down.
  • Intel T2 Mac: hold the Power button to shut down.

An illustrated guide to Recovery on Apple silicon Macs 2.0

There have been substantial changes made to Recovery for Apple silicon Macs in recent versions of macOS. This article guides you through its increasing complexities, using the road map below.

There’s one overriding caution: you will come across two different features with the same name. When you click on Options in the opening screen, that opens Recovery Assistant, where you select the user and authenticate to gain access to the Recovery app with its window of four options. If you open the Utilities menu in that, you’ll see a command Recovery Assistant, which opens another app that calls itself Device Recovery Assistant, but is generally referred to simply as Recovery Assistant, although it’s not the same as the other Recovery Assistant at all.

That’s also available as a downloadable PDF: RecoveryMap26

Apple’s current guide is surprisingly incomplete.

Enter Recovery Mode

To enter Recovery Mode on an Apple silicon Mac, press and hold the Power button until the display shows Loading Startup Options, then release it.

If a Mac running Tahoe has problems starting up correctly, it should automatically restart and open Device Recovery Assistant.

If your Mac has a second boot volume group, it has Recovery volumes paired with each of those bootable systems. As they may have different versions of Recovery, you should prefer to start up in the Recovery paired with a bootable system you want to repair. That should happen if you first start up from that boot system, shut down, and then start up in Recovery. However, this is no longer necessary when changing boot security, as you’re given a choice as to which bootable system to apply changes to.

If there’s a problem with Recovery Mode and your Mac has previously had a macOS update installed, you may instead be able to enter Fallback Recovery Mode. Press the Power button twice in rapid succession, and on the second of those presses hold the button until the display shows Loading Startup Options, then release it. The only drawback with this is that Startup Security Utility can’t be used to make changes to boot security, and Device Recovery Assistant may not be available either.

Startup Options

Language & Wi-Fi settings

To change the keyboard language and layout, use the Keyboard menu at the far right.

To set the Wi-Fi connection, use the Wi-Fi menu at the far right. Its icon indicates connection status and strength of signal.

To change the language used throughout, look for a Change Language command in the menus at the left, for example in the Recovery Assistant menu, where offered.

Bluetooth Setup Assistant

To pair Bluetooth devices using this assistant, press the Power button three times in rapid succession, with no more than one second between each press.

Recovery sysdiagnose

To perform a sysdiagnose when experiencing problems with Recovery, press Control-Option-Shift-Command-. (the dot or period key). This requires the resulting archive to be saved to external storage, which needs to be connected for this purpose.

Startup disk

To restart in Safe Mode, select the disk which you wish to boot from in Safe Mode, press and hold the Shift key then click Continue in Safe Mode underneath it. The Mac then starts up in Safe mode from that disk.

To set the default startup volume, select the disk you wish to make the default boot disk, press and hold the Option key then click Always Use underneath it. The Mac then starts up in normal mode from that disk.

To start up in normal user mode, select the disk you wish to start up from and click Continue underneath it. The Mac then starts up in normal mode from that disk.

Repair Assistant

Press and hold the Command ⌘ and D keys until you hear the startup chime indicating the Mac has restarted into Repair Assistant.

Repair Assistant offers a choice of tests from the available diagnostic suites according to your Mac’s hardware, including:

  • Mac Resource Inspector, to test the main Mac hardware over a period of 1-7 minutes;
  • Display Anomalies, for any built-in LCD panel;
  • Keyboard, only when built-in;
  • Trackpad, only when built-in;
  • Touch ID, for any built-in Touch ID sensor;
  • Audio, to verify audio output using a set of test tones.

Once a test has completed, it’s marked with a green ✅ to indicate success, or a warning triangle or error symbol if the test couldn’t be attempted (power supply when not connected to a laptop), or problems were discovered. Individual tests and their results are listed from each test’s ⓘ button.

Repair Assistant’s substitute for an About window provides details of your Mac, including its serial number, also provided as a QR code, and the version of macOS.

Recovery Assistant

Select the Options icon and click Continue underneath it. You will then be prompted to select a user you know the password for. Do that and click on Next. Enter the password for that user and click Continue.

Erase Mac

To erase the Mac fully without unlocking it, select that command from the Recovery Assistant menu. This completely erases all boot volume groups on the Mac’s internal SSD, ready to reinstall macOS, for which it requires an internet connection.

Recovery Window

To restore from a Time Machine backup, select that item and click Continue.

If your backup is on external storage, this is the time to connect it and locate the backup you want to restore from.

To reinstall macOS, select that item and click Continue. You’ll then pass through the licence agreement and can select which disk to reinstall macOS on, but you don’t get a choice of which version to install.

To read Apple’s help information on Recovery Mode and its tools, or browse the web, select Web Browser and click Continue.

To check and repair volumes, and perform other storage management, select Disk Utility and click Continue.

Recovery Utilities

Access these through the Utilities menu in Recovery.

Startup Security Utility

To change the Security Policy for a boot volume group, open Startup Security Utility and select the boot volume group whose policy you want to inspect or change. Click Unlock and enter the password for that.

This should normally be at Full Security.

To run that boot volume group at Reduced Security, for example to allow the loading of third-party kernel extensions, select Reduced Security instead, then tick the option you want and click OK.

To reduce security further, for example when disabling SIP, select Reduced Security then use Terminal to disable SIP.

Device Recovery Assistant

Use the Recovery Assistant command in the Utilities menu. Note that its app menu identifies itself as Device Recovery Assistant. This requires an internet connection to function. If you’re asked to choose a connection, opt for a Wi-Fi network if possible.

Distinctive to DRA’s opening window is its first aid symbol ⊕. Click on the Continue button to move on.

The next window invites you to send data to Apple for diagnostic purposes. Make your choice as you move on.

If your startup Data volume is protected by FileVault, you’ll then be prompted for the password to unlock it. Once that has been provided, DRA attempts to perform a recovery.

At the end of that, you should see one of three outcomes:

  • no problems were found, and you can restart your Mac back into normal mode;
  • problems were found and repaired successfully, so you can restart your Mac back into normal mode;
  • problems were found but aren’t fully repaired.

When your Mac restarts, it may show a notification that you need to recover iCloud data. If so, open System Settings and you should see a new item in its sidebar to Recover iCloud Data.

To shut down or restart your Mac, use the commands in the Apple  menu. The only way to return to any of the options offered in the initial screen, such as starting up in Safe mode, is to shut down and enter Recovery Mode again.

Miscellaneous

To open Terminal to run commands there, open Terminal from the Utilities menu. Note that you currently get bash rather than zsh, and run as root.

To put that Mac’s disk into Shared Disk mode, select the Share Disk… command from the Utilities menu and follow the instructions.

To browse the Recovery log, select that command from the Window menu.

Leave Recovery

The Apple  menu offers three exit routes: Startup Disk to change that and restart, Restart from the current startup disk, and Shut Down.

❌