Does Safe Mode check and repair disks?

Safe Mode was a useful tool when things started to go awry: there was something not quite right, possibly a software conflict, and starting up with the Shift key held gave you a chance to isolate the problem. It also conveniently flushed various unmentionable caches, and left your user space clean as a whistle again.

Recently, though, it seems to have changed. What used to be a quick check of your boot disk file system has, by some accounts, turned into a very long inspection of all the snapshots stored in APFS, something not even attempted by Recovery Mode, unless you make it so. According to Apple’s current support page, Safe Mode does three things:

it verifies the boot disk and, if there are any directory issues with it, it attempts its repair;
it blocks the loading of many kernel extensions, startup and login items, and user-installed fonts;
it deletes font caches, the kernel cache, and other system caches.

The second of those limits its usefulness, as some of the blocked items prevent some sub-systems from working normally. If you’re trying to isolate a problem which affects one of those sub-systems, Safe Mode won’t help.

But the question which was raised here was whether Safe Mode performs a full check and repair of your boot disk, in the way that would be performed by starting up in Recovery Mode and running First Aid in Disk Utility. Of course, that should be easy to answer by trying it then browsing the fsck_apfs log in /var/log.

According to Apple, “Your Mac automatically checks the directory of your startup disk when you start up in safe mode. This is similar to what happens when you use Disk Utility to verify or repair your disk. If the directory is repaired, your Mac automatically restarts.” I note the carefully chosen words “similar to”, which isn’t the same as “the same as”, and specific reference to directory checking and repair, which is more limited than a full fsck_apfs. It also doesn’t mention checks on other mounted volumes, or on APFS snapshots.

I’ve now put both my active Macs into Safe Mode. One’s an iMac Pro running fully updated Mojave with Time Machine active, and a couple of dozen snapshots accessible as well as the backup drive, and external RAID in HFS+. The other is my Catalina test system, a MacBook Pro 2017 without Touch Bar (no T1/T2 chip) running Catalina 10.15, with an external 750 GB SSD but no Time Machine or backups, so probably no snapshots either.

Both systems seemed to accomplish objectives 2 and 3 above just fine, but disk checking and repair remain a mystery.

Safe Mode in Mojave with Time Machine

The iMac Pro, running Mojave and Time Machine, took half an hour – yes, 30 minutes – to start up in Safe Mode, requiring two separate logins, the first to unlock its T2-encrypted internal SSD at the start, the second half an hour later to log on as the user. After all that, there isn’t any evidence that it checked any disks or snapshots, although given how long it took, I can only presume that it did run fsck_apfs on the boot disk, and that it trudged through each of the snapshots it could find. As it didn’t restart automatically, I must presume that no APFS directory repair was performed.

All attempts to find any record of what happened during that period of thirty minutes have failed. The fsck_apfs log in /var/log only records quick checks which occurred before starting up in Safe Mode, and those performed afterwards. The unified log is a complete blank for the period:
10:07:07.590516 MessagingAppIPC_Shutdown 10:07:07.590603 going to call exit() … 10:07:10.076313 TIC TCP Conn Event [24:0x7fe617403030]: 7 10:07:11.036891 === system wallclock time adjusted 10:36:21.785491 Sandboxing init issue, couldn't find profile in default paths, attempting default compiled profile 10:36:21.793885 Sandboxing init issue resolved: "Success" 10:36:22.285930 === system wallclock time adjusted … 10:36:22.332703 logind started 10:36:22.332823 event logs in /.fseventsd out of sync with volume. destroying old logs. (15 1689 1755) … 10:36:22.336443 Safe boot is enabled

Safe Mode in Catalina without Time Machine

The MacBook Pro, running Catalina without Time Machine, booted as quickly in Safe Mode as it does normally. Its fsck_apfs log and unified log were active throughout the period of the Safe boot, but show no evidence of performing any full fsck_apfs check and repair on any of the accessible volumes. For those which were available for checking, like the Recovery volume, it reported that it only performed a ‘QUICKCHECK’, and that the file system was ‘CLEAN’. Attempts to check the Data boot volume resulted in the error that the volume was mounted with write access, and “please re-run with -l”. No re-runs were performed, though.

Entries in the unified log were complete from the start of the boot process, highlights including:
13:08:23.000000 === system boot: A52B71E5-44BB-48C5-8A20-ADF48D5F71AB 13:08:23.000000 === log class: in-memory begins … 13:08:23.002695 Darwin Kernel Version 19.0.0: Wed Sep 25 20:18:50 PDT 2019; root:xnu-6153.11.26~2/RELEASE_X86_64 … 13:08:23.054764 SAFE BOOT DETECTED - only valid OSBundleRequired kexts will be loaded. … 13:08:24.080006 ROSV: apfs mounted RO and is the system volume of a volume group and mounted as the root fs: creating the shadow fs_root 13:08:24.080063 apfs_vfsop_mount:1463: mounted volume: Macintosh HD 13:08:24.081282 attempting kernel mount for data volume... 13:08:24.084126 attempting kernel mount for vm volume...

This appears to be a completely different Safe Boot process, which doesn’t attempt the same fsck_apfs checks that appear to take place in Mojave.

Should you use Safe Mode to check and repair your startup volume?

The alternative to trusting fsck_apfs in Safe Mode is to boot into Recovery and run First Aid in Disk Utility. Whether you’re running Mojave or Catalina, that is far preferable as:

you can be sure that the correct volume has been checked properly, and view the results at the time;
if you want to use different options with fsck_apfs, you can do so in Terminal;
the process is no slower than booting in Safe Mode in Mojave;
the process can check your boot Data volume, unlike Safe Mode in Catalina;
if Disk Utility or fsck_apfs finds errors it cannot repair, you can erase the volume or perform other actions.

One major disadvantage of both the Safe and Recovery Mode approaches is that, in Mojave at least, there’s no way to avoid the time-consuming checks on snapshots. On Macs running Time Machine backups, or presumably with snapshots saved using Carbon Copy Cloner, those checks take an inordinate time, and the user should be able to opt out of them if possible.

Maybe Safe Mode is becoming more usable again in Catalina, although this appears largely to be the result of abandoning attempts to run full file system checks. That is probably no bad thing, so long as you don’t expect Safe Mode to verify and repair your boot disk.

11Comments

Add yours

1

EcleX on October 15, 2019 at 7:43 am

Thanks. Fantastic information, as usual. It would be also useful an article with Table, diagram or similar comparing the actions carried out by the different macOS repair options (macOS 10.15 Catalina, but also older ones before APFS like macOS 10.12 Sierra):

– Using Disk Utility from the booting disk.
– Using Disk Utility from other disk, different from the booting one.

– Booting in safe mode until the login window and then rebooting normally.
– Booting in safe mode until the login window and then login and then rebooting normally. Is this case, it is necessary to wait a bit after the Desktop shows in safe mode booting before rebooting normally? How long? Until Activity Monitor or MenuMeters show no CPU/disk activity?

– Running fsck using Terminal (if possible) from the booting disk.
– Running fsck using Recovery Mode from the booting disk.
– Running fsck using Recovery Mode from other disk, different from the booting one.

– Using applications like DiskWarrior to rebuild the directory of disk and defragmenting the directory optimization index.

– Any other possibility.

LikeLiked by 1 person
- 2
  
  hoakley on October 15, 2019 at 8:02 am
  
  You already have the answers for Mojave and Catalina in this article, coupled with the detail above.
  Forget relying on fsck_apfs in Safe Mode – see above. It’s a waste of time.
  If you want to run fsck_apfs to its best advantage, restart in Recovery Mode, or from another bootable disk. It doesn’t matter which. If you’re happy with the standard version provided by Disk Utility, use that, as it handles the unmounting and remounting for you. If you want another option, then use the command line instead.
  As no other tool at present can work with APFS directories, or perform any sort of repair, forget them – Disk Utility and fsck_apfs are the only game in town for the foreseeable future.
  HFS+ is different, but apart from TM backup disks shouldn’t be in common use any more. macOS prior to High Sierra isn’t supported any more, AFAIK, so you’re on your own there.
  That seems fairly simple and clear to me.
  Howard.
  
  LikeLike
3

EcleX on October 15, 2019 at 11:29 am

Thanks. OK, I will run Disk Utility booting from other disk. But is there any advantage of booting also in safe mode besides that? i mean, for repairs, not for cleaning caches and other housekeeping that I rather do with Cocktail
https://www.maintain.se/cocktail

LikeLiked by 1 person
- 4
  
  hoakley on October 15, 2019 at 11:50 am
  
  Not according to Apple.
  Howard.
  
  LikeLike
5

Michael Bach on October 15, 2019 at 3:23 pm

Thanks, excellent, as usual
If you set your mac to always being verbose on booting, you can read (in tiny font) what’s going on when safe booting.

LikeLiked by 1 person
- 6
  
  hoakley on October 15, 2019 at 3:54 pm
  
  Thank you – yes, that’s a good point, although I don’t think there’s any way of saving that pseudo-log, so once something has scrolled past, it has vanished.
  Howard.
  
  LikeLike
  - 7
    
    Michael Bach on October 15, 2019 at 4:00 pm
    
    Indeed, it scrolls right off, sometimes very fast. And taking a photo is not that useful :).
    Best, Michael
    
    LikeLiked by 1 person
  - 8
    
    Ingo on October 17, 2019 at 5:34 pm
    
    Yes, but if there are more than two snapshots present, you’ll get some time to read the messages of the fsck at least…
    
    LikeLiked by 1 person
    - 9
      
      hoakley on October 17, 2019 at 5:44 pm
      
      With 25 or so, I’ve got time to write a short novel 🙂
      Howard.
      
      LikeLike
10

Jorge on March 28, 2020 at 11:58 am

How do you Boot in safe mode if your only keyboard is Bluetooth? Any terminal cmd? (catalina 10.15.3 iMac)

LikeLiked by 1 person
- 11
  
  hoakley on March 28, 2020 at 12:25 pm
  
  Some Macs may still enter Safe mode with a Bluetooth keyboard, but in my experience it’s now very unreliable.
  If your keyboard is rechargeable, then simply connect its charging cable before starting up: it then works as USB. If it can’t be connected, then you’ll need a cheap USB keyboard to use in an emergency.
  I don’t know of any other way of getting into Safe mode, I’m afraid.
  Howard.
  
  LikeLike

Share this:

Related