Developer Forums

How can I check if my computer has been entered into the macOS recovery by someone, and Can I view the relevant logs for macOS recovery?

Privacy & Security General macOS

sephiroth_six OP

Created Aug ’24

Replies 1

Boosts 0

Views 243

Participants 2

How can I check if my computer has been entered into the macOS recovery by someone, and Can I view the relevant logs for macOS recovery?

Answered by DTS Engineer in 800427022

How can I check if my computer has been entered into the macOS recovery by someone, and

I'm not aware of any consistent/reliable way to do this. If you boot into recovery mode and explore the system via terminal, you might be able to infer something based on things like modification dates but it would rely on guess work and inference. Keep in mind here that the recovery volume can't rely on any other volume (they might be damaged) and minimizes it's overall storage use. That's partly to avoid "wasting" the users storage, but it's primarily because it cannot assume that ANY storage is available* and any growth carries risk of triggering additional failures.

*After all, you might be booting into recovery mode... because your disk is full.

Can I view the relevant logs for macOS recovery?

I'm not sure we really do very much persistent logging in recovery mode.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware

Boost

DTS Engineer OP

Apple

Aug ’24

Accepted Answer

How can I check if my computer has been entered into the macOS recovery by someone, and

I'm not aware of any consistent/reliable way to do this. If you boot into recovery mode and explore the system via terminal, you might be able to infer something based on things like modification dates but it would rely on guess work and inference. Keep in mind here that the recovery volume can't rely on any other volume (they might be damaged) and minimizes it's overall storage use. That's partly to avoid "wasting" the users storage, but it's primarily because it cannot assume that ANY storage is available* and any growth carries risk of triggering additional failures.

*After all, you might be booting into recovery mode... because your disk is full.

Can I view the relevant logs for macOS recovery?

I'm not sure we really do very much persistent logging in recovery mode.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware

0

Q