Does Safe Mode check and repair disks?

Safe Mode was a useful tool when things started to go awry: there was something not quite right, possibly a software conflict, and starting up with the Shift key held gave you a chance to isolate the problem. It also conveniently flushed various unmentionable caches, and left your user space clean as a whistle again.

Recently, though, it seems to have changed. What used to be a quick check of your boot disk file system has, by some accounts, turned into a very long inspection of all the snapshots stored in APFS, something not even attempted by Recovery Mode, unless you make it so. According to Apple’s current support page, Safe Mode does three things:

  1. it verifies the boot disk and, if there are any directory issues with it, it attempts its repair;
  2. it blocks the loading of many kernel extensions, startup and login items, and user-installed fonts;
  3. it deletes font caches, the kernel cache, and other system caches.

The second of those limits its usefulness, as some of the blocked items prevent some sub-systems from working normally. If you’re trying to isolate a problem which affects one of those sub-systems, Safe Mode won’t help.

But the question which was raised here was whether Safe Mode performs a full check and repair of your boot disk, in the way that would be performed by starting up in Recovery Mode and running First Aid in Disk Utility. Of course, that should be easy to answer by trying it then browsing the fsck_apfs log in /var/log.

According to Apple, “Your Mac automatically checks the directory of your startup disk when you start up in safe mode. This is similar to what happens when you use Disk Utility to verify or repair your disk. If the directory is repaired, your Mac automatically restarts.” I note the carefully chosen words “similar to”, which isn’t the same as “the same as”, and specific reference to directory checking and repair, which is more limited than a full fsck_apfs. It also doesn’t mention checks on other mounted volumes, or on APFS snapshots.

I’ve now put both my active Macs into Safe Mode. One’s an iMac Pro running fully updated Mojave with Time Machine active, and a couple of dozen snapshots accessible as well as the backup drive, and external RAID in HFS+. The other is my Catalina test system, a MacBook Pro 2017 without Touch Bar (no T1/T2 chip) running Catalina 10.15, with an external 750 GB SSD but no Time Machine or backups, so probably no snapshots either.

Both systems seemed to accomplish objectives 2 and 3 above just fine, but disk checking and repair remain a mystery.

Safe Mode in Mojave with Time Machine

The iMac Pro, running Mojave and Time Machine, took half an hour – yes, 30 minutes – to start up in Safe Mode, requiring two separate logins, the first to unlock its T2-encrypted internal SSD at the start, the second half an hour later to log on as the user. After all that, there isn’t any evidence that it checked any disks or snapshots, although given how long it took, I can only presume that it did run fsck_apfs on the boot disk, and that it trudged through each of the snapshots it could find. As it didn’t restart automatically, I must presume that no APFS directory repair was performed.

All attempts to find any record of what happened during that period of thirty minutes have failed. The fsck_apfs log in /var/log only records quick checks which occurred before starting up in Safe Mode, and those performed afterwards. The unified log is a complete blank for the period:
10:07:07.590516 MessagingAppIPC_Shutdown
10:07:07.590603 going to call exit()

10:07:10.076313 TIC TCP Conn Event [24:0x7fe617403030]: 7
10:07:11.036891 === system wallclock time adjusted
10:36:21.785491 Sandboxing init issue, couldn't find profile in default paths, attempting default compiled profile
10:36:21.793885 Sandboxing init issue resolved: "Success"
10:36:22.285930 === system wallclock time adjusted

10:36:22.332703 logind started
10:36:22.332823 event logs in /.fseventsd out of sync with volume. destroying old logs. (15 1689 1755)

10:36:22.336443 Safe boot is enabled

Safe Mode in Catalina without Time Machine

The MacBook Pro, running Catalina without Time Machine, booted as quickly in Safe Mode as it does normally. Its fsck_apfs log and unified log were active throughout the period of the Safe boot, but show no evidence of performing any full fsck_apfs check and repair on any of the accessible volumes. For those which were available for checking, like the Recovery volume, it reported that it only performed a ‘QUICKCHECK’, and that the file system was ‘CLEAN’. Attempts to check the Data boot volume resulted in the error that the volume was mounted with write access, and “please re-run with -l”. No re-runs were performed, though.

Entries in the unified log were complete from the start of the boot process, highlights including:
13:08:23.000000 === system boot: A52B71E5-44BB-48C5-8A20-ADF48D5F71AB
13:08:23.000000 === log class: in-memory begins

13:08:23.002695 Darwin Kernel Version 19.0.0: Wed Sep 25 20:18:50 PDT 2019; root:xnu-6153.11.26~2/RELEASE_X86_64

13:08:23.054764 SAFE BOOT DETECTED - only valid OSBundleRequired kexts will be loaded.

13:08:24.080006 ROSV: apfs mounted RO and is the system volume of a volume group and mounted as the root fs: creating the shadow fs_root
13:08:24.080063 apfs_vfsop_mount:1463: mounted volume: Macintosh HD
13:08:24.081282 attempting kernel mount for data volume...
13:08:24.084126 attempting kernel mount for vm volume...

This appears to be a completely different Safe Boot process, which doesn’t attempt the same fsck_apfs checks that appear to take place in Mojave.

Should you use Safe Mode to check and repair your startup volume?

The alternative to trusting fsck_apfs in Safe Mode is to boot into Recovery and run First Aid in Disk Utility. Whether you’re running Mojave or Catalina, that is far preferable as:

  • you can be sure that the correct volume has been checked properly, and view the results at the time;
  • if you want to use different options with fsck_apfs, you can do so in Terminal;
  • the process is no slower than booting in Safe Mode in Mojave;
  • the process can check your boot Data volume, unlike Safe Mode in Catalina;
  • if Disk Utility or fsck_apfs finds errors it cannot repair, you can erase the volume or perform other actions.

One major disadvantage of both the Safe and Recovery Mode approaches is that, in Mojave at least, there’s no way to avoid the time-consuming checks on snapshots. On Macs running Time Machine backups, or presumably with snapshots saved using Carbon Copy Cloner, those checks take an inordinate time, and the user should be able to opt out of them if possible.

Maybe Safe Mode is becoming more usable again in Catalina, although this appears largely to be the result of abandoning attempts to run full file system checks. That is probably no bad thing, so long as you don’t expect Safe Mode to verify and repair your boot disk.