Several years ago, Apple began hiding disk partitions and volumes on the startup drive. The first was a secret volume with a tiny operating system on it that would let you boot from it, after which you could restore from a Time Machine backup, run First Aid in Disk Utility, or reinstall Mac OS X or macOS. Over the years, Apple has multiplied those hidden locations and added more sophistication to what they offer.

These boot volumes are:

• recoveryOS: The current name and form of the special volume described above, which boots into the Recovery Assistant “app.” You can run Disk Utility (and First Aid), reinstall macOS, launch Safari to access Apple Support pages, modify startup security settings (rarely required these days), and access Terminal. With Terminal, you can reset your macOS password. If your Mac can’t start up properly, it will try to launch the Recovery process within recoveryOS, which performs automatic repairs that Apple doesn’t document. If successful, you can then restart into macOS.

recoveryOS has many faces, including these four, here showing Activate Mac after it was unlock following a Find My lock. Fallback recoveryOS: If recoveryOS is damaged—and that can happen—you can press the power button twice, quickly, and then keep holding it the second time. This fallback recovery volume can’t change startup security, but it can help you diagnose what’s going on. This is the duct-tape belt that helps if your pants come unbuttoned (macOS won’t boot) and your suspenders break (regular recoveryOS fails). * Repair Assistant: From a powered-down state, press the power button until you hear the startup chime, then press and hold Command-D. (On an Intel Mac, hold the D key at startup.) The Diagnostics app can run hardware tests that might help narrow down a problem before you bring in Apple Support, or they may ask you to boot into that mode and share the results of the tests they have you run. Repair Assistant can fail, too, if its volume is damaged. You may then have to perform a special “revive or restore” operation, which requires another Mac. Or you may need a full reinstall using a bootable macOS installer. * macOS:* macOS is a sort of hidden boot volume for the last several releases. You don’t boot from the system; instead, a read-only snapshot of the system is mounted, and then booted from. This is part of Apple making system resources immutable through cryptography and at startup.

Besides using recoveryOS for the above tasks, you might also need to use it to unlock your Mac after locking it in Find My and to reset your password using a FileVault Recovery Key. Here’s how.

Unlock your MacWhen you lock devices in Find My, they appear with a question mark overlaying their icon.While it’s not a common scenario, it could happen to you: you accidentally leave your Mac somewhere, or it’s stolen. Thinking quickly, you launch Find My on another of your devices or go to iCloud.com/find and log in. You then tap or click a few buttons to lock your Mac. If the Mac is connected to the Internet, it restarts and locks immediately. (Despite promising to display the message you entered when you locked it, macOS does not do so.) If it’s not connected, it restarts the next time it has Internet access.

The account used to lock the Mac is the only one that can unlock it, and you must be in front of the Mac to perform that operation. Apple limits each Mac to having Find My enabled from a single account. Here are the steps:

1. When you see the macOS Recovery title, click the account profile below it. Enter the account’s password and click Continue.
2. If you entered it correctly, “Authentication succeeded” appears. Click Restart.
3. The Mac restarts and shows Activate Mac after it boots up. This time, all the active macOS accounts are shown. Click one, and then enter its password. Click Next.
4. You now can choose to either use your Apple Account or a macOS password to continue. If you opt for the Apple Account, enter the full address or phone number as shown. Then enter the account’s password. Otherwise, you can click to enter the Mac password, which Apple says is the last one used to unlock the Mac in a regular session before it was locked. If you’re the only user on the Mac, that’s easy to figure out. (In testing with Golden Gate public beta 2, I wasn’t able to get the Mac password option to work, and I’ve had it fail in Tahoe, too.) Sometimes neither works. Choose Restart from the Apple menu in that case and try again.
5. On a successful entry, the Mac restarts yet again after a one-minute countdown. Enter your password when prompted to start up into a regular session.
6. Apple Pay will have been disabled, and your iCloud sync will probably be paused as well. When prompted after the macOS session starts, enter your Apple Account password (or passwords if you have multiple accounts linked to your macOS account).

If you try this too often, as I did while testing, or for other security reasons only Apple knows, your Apple Account may be locked. At step 6, I was told I had to reset my Apple Account password from one of my other devices; all four linked to the account were shown. I made that change. In the Golden Gate second public beta, clicking Unlock Account did nothing before or after changing. I was able to click Cancel, complete step 4 again with the new Apple Account password, and proceed to step 5 and restart.1

If your Apple Account becomes locked, you have to reset your Apple Account password on a linked device.Years ago, when you locked your Mac, you had to set a passcode to unlock it. While that isn’t supported on M-series Macs or Intel Macs with the T2 Security Chip, the email Apple sends still shows an image of a screen where you would enter that code and says you can only unlock your Mac with that non-existent passcode.

Apple’s email after you lock your Mac shows an outdated image and provides outdated information about the unlock procedure.Unlock via FileVaultIf you try to log into your Mac and can’t recall the password or it isn’t accepted, you can use your FileVault Recovery Key to unlock the volume and reset your password. The Recovery Key is a long code that’s a last-ditch way to unlock your startup volume. It’s also a back-door way to help with a post-Find My lock operation if your password won’t work or you’ve forgotten it.

[I’ve described how to set up FileVault and how to deal with the Recovery Key in “FileVault on macOS Tahoe uses iCloud Keychain to store its Recovery Key” and “FileVault keys can’t be escrowed in iCloud anymore.”]

Here’s how to use your Recovery Key to unlock FileVault:

1. At the login prompt, click the ? icon to the right of Enter Password to bring up the Reset Password link. (This also appears if you enter your password incorrectly a few times.) Click Reset Password.
2. Your Mac restarts into Recovery Assistant using its Reset Password pathway. Enter your Recovery Key (see articles above). Click Next.
3. If you entered your Recovery Key correctly, you are prompted to enter a new password for the account you rebooted from, and confirm it. Do so.
4. When you restart, you can now enter the new password.

Enter your FileVault Recovery Key to then be able to reset your macOS password.If you forgot or can’t enter a correct password for unlocking your Mac in step 1 in the previous section, you can click “Forgot all passwords?” This will launch the FileVault-based password reset, let you reset the password for that account, then proceed with unlocking.

For further readingTo learn a lot more about Find My locking and unlocking, consult my book Take Control of Find My and AirTags, which covers the whole ecosystem. For a lot of insight into iOS, iPadOS, and macOS security, including FileVault, check out Take Control of Securing Your Apple Devices.

Revisions of those two titles for the 27 series of operating systems are coming out soon. You can purchase either today and receive a free update to the new version when it’s out.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

---

1. In the screenshot, you’ll notice the title is Update Phone Number, even though I have no opportunity to do so. This may be fixed by Apple later, though I doubt it. ↩