M1 Macs have a third Recovery mode

If you’ve been following the story of Recovery Modes on M1 Macs, you should now be aware that there are often two: 1 True Recovery (1TR) which you engage by starting your Mac up with the Power button held until it loads Options, and Fallback Recovery (frOS) which requires a first short press on the Power button followed by a second which is held until it loads Options. This article describes a third Recovery Mode, simply known as recoveryOS.

Among the most important of those is Startup Security Utility, which lets you change security level of available boot volume groups. This is the only way that you can do that, a design decision made by Apple which it explains in its Platform Security Guide: “On a Mac with Apple silicon, System Security Utility” [actually Startup Security Utility] “indicates the overall user-configured security state of macOS, such as the booting of a kext or the configuration of System Integrity Protection (SIP). If changing a security setting would significantly degrade security or make the system easier to compromise, users must enter into recoveryOS by holding the power button (so that malware can’t trigger the signal, only a human with physical access can), in order to make the change.”

1TR runs only from its own container on the internal SSD, and boots as its own operating system, which Apple calls recoveryOS. It also provides key tools such as Disk Utility, Terminal, and the ability to install the current version of macOS, making it a complete recovery environment.

Leave a Comment