When a macOS Update Goes Wrong: The Tahoe Recovery Playbook

A macOS update goes wrong in one of two ways, and they feel completely different. In the first, you start the installer in the evening, come back an hour later, and the progress bar is sitting in the same place it was when you left. Nothing is moving. The estimated time remaining has been stuck on the same number long enough that you have started to wonder whether the number means anything at all. In the second, the update finished, the Mac restarted, and now it will not stay up: Apple logo, progress bar, black, Apple logo, progress bar, black, over and over, and your Mac won't boot into anything you can use.

Both of those situations have a correct first move, and in both cases the correct first move is the one most people skip. The instinct is to reach for the power button in the first case and to keep restarting in the second. One of those is usually wrong and the other is usually right, and the reason has nothing to do with luck. It has to do with the fact that a macOS update in 2026 is a fundamentally different operation from the one people remember from the Mojave era, and the failure modes changed with it.

Since Big Sur, the system your Mac boots from is a cryptographically sealed, read-only APFS snapshot. Your files live on a completely separate volume, and for most of the duration of an update that volume is not even mounted. That single architectural fact reshapes everything: it changes what can break, it changes what an interrupted update can and cannot damage, and it changes what recovery looks like. It is also why the old advice, the "just reinstall over the top and it will sort itself out" advice, produces a different result now than it did five years ago.

This article is an ordered playbook for the macOS 26 generation. It covers what is actually happening inside an update, a triage tree that maps symptom to first action, a section for each distinct failure mode, Tahoe's new Device Recovery Assistant, how to get into Recovery on each architecture and what each utility in there is for, how to reinstall without erasing, and how reverting works along with exactly what it costs. Some of it is verified on a real Mac and shown as commands you can run yourself. Where Apple has not documented something, this article says so instead of guessing.

Key Takeaways

• Your boot volume is a sealed read-only snapshot, and you can prove it in one command. On a test Mac running macOS 26.5.2 (build 25F84), mount | grep ' on / ' returned /dev/disk3s1s1 on / (apfs, sealed, local, read-only, journaled). The sealed and read-only flags are why a half-applied update cannot leave you with a subtly corrupt System volume the way it could in the HFS+ era.
• An apparently frozen progress bar is usually a lying progress bar. Howard Oakley documented the macOS 26.4 update sitting at 98.6% and "five minutes remaining" for twelve minutes and seven seconds while log entries showed preparation continuing the entire time, and he notes slower Macs can take 30 minutes or more.
• For a boot loop, the first move is to stop the loop, not to restart into it again. Howard Oakley's instruction is direct: press and hold the power button until the Mac shuts down. A Mac in a loop is hitting an early kernel panic and restarting, and every cycle is another panic rather than another chance.
• Tahoe added Device Recovery Assistant, and it needs the internet to be useful. Apple documents that it opens automatically when your Mac has an issue that prevents startup, that it needs a connection to download the latest information about software issues affecting your Mac, and Apple also documents that captive networks and networks requiring 802.1X are not supported in macOS Recovery.
• Reverting an Apple silicon Mac to an earlier macOS version erases it. Apple's own description of a DFU restore is that it erases and installs macOS on your internal storage with data on internal volumes becoming unrecoverable. A verified backup is not a nice-to-have before you go down that road; it is the entire precondition.

How a Modern macOS Update Actually Works

Almost every bad decision people make during a failed update comes from carrying over a mental model that stopped being accurate in 2020. It is worth spending a few minutes on the real one, because the playbook that follows is derived from it rather than from folklore.

The Sealed System Volume Is Not a Metaphor

When people say the macOS system volume is "read-only," it sounds like a permissions setting, something an administrator could flip. It is not. It is a cryptographic seal over the entire volume, and the running system is booted from a snapshot of that sealed state.

You can see this on any Mac running Big Sur or later. On a test Apple silicon Mac running macOS 26.5.2 (build 25F84), this command:

mount | grep ' on / '

returned exactly this:

/dev/disk3s1s1 on / (apfs, sealed, local, read-only, journaled)

Three things in that line matter. The device is disk3s1s1, not disk3s1. The extra s1 is the snapshot: your Mac is running from a snapshot of the System volume, not from the System volume itself. The flag sealed means the volume's contents are covered by a hash tree that the system verifies. And read-only means what it says, at a level that no admin password changes.

Howard Oakley, writing at The Eclectic Light Company, puts the consequence plainly: "macOS booted from an SSV is very different to that of the past. Macs with T2 and especially Apple silicon chips verify the contents of the SSV down to the last bit." That verification is against Apple's reference for what a correct installation looks like. It is why the class of failure that dominated the old days, the partially-written system directory that boots but behaves strangely, effectively cannot happen anymore. Either the seal verifies and you have exactly what Apple shipped, or it does not verify and the Mac refuses to boot from it.

That is a trade. You lose the ability to end up in a mushy half-broken state, and you gain the ability to end up in a binary won't-boot state. The recovery playbook is different for a binary failure than for a mushy one.

The Volume Group: Who Does What

Run this and you will see the whole structure:

diskutil apfs list

On the same test Mac, the container listed several volumes with distinct roles. The System role volume, disk3s1, reported Sealed: Yes, along with a Snapshot: UUID, Snapshot Disk: disk3s1s1, Snapshot Mount Point: /, and Snapshot Sealed: Yes. Every other volume in the group, Preboot, Recovery, the Data volume named "Macintosh HD - Data", and VM, reported Sealed: No.

That distribution tells you the design in one glance:

Volume role	Sealed	What lives there	What it means during an update
System	Yes	The macOS installation itself, booted via a snapshot	Replaced wholesale by the update; the seal is verified before it is used
Data	No	Your home folder, apps you installed, settings, everything you actually own	Unmounted for most of the update, then rejoined to the group at the end
Preboot	No	Per-volume-group boot support files, including what the Mac needs before the main system is available	Updated during the process; damage here shows up as a Mac that cannot find or start its system
Recovery	No	The recovery environment, including its own utilities	Your parachute; on Apple silicon there is more than one, which matters later
VM	No	Swap and sleep image storage	Regenerated; not something to worry about

The System and Data volumes together are what Apple calls a volume group, and macOS presents them to you as one disk with the help of firmlinks. That illusion is convenient right up until the moment the update breaks and you need to reason about which half is in trouble.

Your Data Volume Is Unmounted for Most of the Update

This is the fact that changes the most behavior, and almost nobody knows it. Howard Oakley: "Since Big Sur, it has become more likely to be an unfortunate side-effect. In those more recent versions, for almost the whole duration of the update, the Data volume containing your files and apps is unmounted."

Read that again, because there is a considerable amount of reassurance packed into it. For the bulk of an update, the volume holding your documents, your photo library, your mail, your Xcode projects, and your applications is not mounted. It is not being written to. It is not being reorganized. All the action is happening on the System volume, which is going to be sealed and verified before anything trusts it.

The practical implication: an update that dies in the middle is much less likely to have damaged your files than intuition suggests, because for most of that window your files were not in play. It does not make interrupting an update a good idea. It does mean that if you did end up having to force a shutdown, the reasonable expectation is a Mac that cannot boot rather than a Mac with shredded documents.

It also explains a specific, common, and alarming symptom covered later: a Mac that boots after an update and appears to have lost files or apps. The Data volume rejoining the group at the end of the process is where a small number of things can end up somewhere other than where you left them.

Why It Looks Frozen, and How Long Normal Really Is

The single most destructive thing people do to their Macs during an update is decide, on the basis of a stationary progress bar, that the machine has hung.

Howard Oakley documented this precisely for the macOS 26.4 update. The bar sat at 98.6% showing "five minutes remaining." That five minutes took twelve minutes and seven seconds, and, in his words, "log entries make it clear that preparation continued throughout that time." His explanation is that the update was large and "the work required to verify its contents and complete its preparation was incorrectly reported in both percent completion and time remaining." His advice is to leave the Mac to finish, noting delays "possibly on slower Macs as long as 30 minutes or more."

Two structural reasons sit behind this. First, verifying a sealed system volume means hashing a great deal of data, and that work is not linear with the visible progress of file copying, so the estimator is fitting a curve to the wrong variable. Second, some of the heaviest phases run before the graphical progress UI has a way to describe them, so the bar has nothing new to say while the machine is at its busiest.

The consequence for you is a rule: a stationary bar is not evidence of a hang. Absence of disk and CPU activity over a long window is evidence of a hang. Those are different observations, and the section on stalled updates below explains how to make the second one.

The Triage Decision Tree

Before any specific fix, two things need to happen in order.

Step Zero: Establish Your Backup Position

Howard Oakley's ordered list of what to do when an update goes wrong begins with confirming you have a current backup, and it begins there for a reason that becomes obvious three sections from now: the most powerful recovery tools on Apple silicon are destructive, and whether you can use them is decided entirely by what you backed up before the trouble started.

So answer this honestly before you touch anything:

1. When did your last Time Machine backup or clone complete? Not when was it scheduled. When did it complete.
2. Is the backup disk physically connected and healthy right now, or is it in a drawer?
3. If your Data volume were erased in the next ten minutes, what would you lose?

The answer to question three is the number that should govern every subsequent decision. If it is "nothing, I have a verified backup from this morning," you can move quickly and try aggressive things. If it is "eleven months of work," then everything below stops being a troubleshooting exercise and becomes a data-preservation exercise, and the correct move is to get the data off the machine before attempting repairs. A Mac that will not boot can often still hand over its files: on Apple silicon, Share Disk mode in Recovery presents the internal disk to another Mac over a cable, and a Mac that boots into Safe mode can copy files out normally. If you have never set this up properly, our Mac backup strategy comparison covers what Time Machine, iCloud, and a bootable clone each actually protect you against, because they are not interchangeable.

Step One: Match Symptom to First Action

What you are seeing	First action	Do not
Progress bar not moving, Mac warm, fans audible	Wait. Check for CPU and disk activity if you can. Give it 30+ minutes past your patience threshold	Force a shutdown on the first stall
Progress bar not moving for hours, Mac cold and silent, no disk light	Force shutdown with a long power-button press, then restart normally	Pull the power cord from a desktop mid-write
Apple logo, then restart, repeating	Hold the power button until it shuts down. Then start normally, once	Let the loop keep running
Black screen, pointer moves	Wait several minutes, then force shutdown and start in Safe mode	Assume the display hardware failed
Boots to login, but crashes shortly after	Safe mode, wait about two minutes, restart normally	Reinstall before you know whether Safe mode is clean
Boots fine, but files or apps appear gone	Check the Trash and /Users/Shared/Relocated Items	Restore from backup before checking those two places
Tahoe shows a first-aid screen on its own	Let Device Recovery Assistant run; connect it to a network it can use	Interrupt it
Repeated kernel panics with no pattern	Run sysdiagnose, then reinstall from Recovery	Erase anything yet

The rest of this article is one section per row.

Failure Mode: The Progress Bar That Stopped Moving

How to Tell a Stalled Update From a Slow One

There is a real difference between a machine that is working hard and a machine that is dead, and you can usually tell them apart without any special tools.

Signs it is still working: the chassis is warm, particularly near the vents on a laptop or the back of a desktop. Fans are running or cycling. On a Mac with a visible drive activity pattern, there is one. The progress bar, watched for several minutes without blinking, has moved by a hair. The screen has changed at all in the past twenty minutes, including going from bar to Apple logo to bar.

Signs it may genuinely be stuck: the machine is cold to the touch, silent, and has shown the identical screen for hours rather than tens of minutes. Note the word "hours." Howard Oakley's guidance about waiting through apparent freezes is not a suggestion to wait ten minutes.

If the Mac is far enough along that macOS is running underneath the installer, Howard Oakley's suggestion is to open Activity Monitor and look for sustained CPU from softwareupdated or related processes along with disk activity. That is the strongest positive evidence available. In the more common case where the Mac is showing a full-screen installer with no way to reach Activity Monitor, you are relying on heat, sound, and time.

When Waiting Stops Being the Right Answer

Set a threshold and commit to it rather than making the decision emotionally at hour two. A defensible threshold looks like this: on a Mac with an internal SSD, if the screen has been visually identical and the machine cold and silent for more than about two hours, treat it as stalled. Older Macs, Macs with spinning drives, and Macs installing over a slow network connection deserve more room.

When you do decide it is stalled, the way you stop it matters:

1. Press and hold the power button until the Mac shuts down completely. Do not tap it.
2. Wait ten seconds after it has gone dark.
3. Press the power button once to start it normally.

Most of the time, one of two things happens. The Mac picks up the update where it left off and finishes, because the installer is designed to be resumable and the sealed-volume design means it has not left a corrupt system behind. Or the Mac boots back into the version you were on before, having discarded the attempt.

What you should not do is remove power from a desktop Mac or pull a laptop's battery equivalent. A clean shutdown request, even a forced one, lets firmware and storage settle in a way that yanking power does not.

If the update is failing repeatedly rather than stalling once, particularly with a message about the installation failing, the cause is frequently something mundane rather than something structural. Our guide to macOS updates that stop with installation failed or not enough space covers the free-space arithmetic, which is considerably less forgiving than the number the installer quotes you.

Failure Mode: The Boot Loop

What a Boot Loop Actually Is

A boot loop looks like indecision on the Mac's part. It is not. Howard Oakley describes the mechanism exactly: the Mac "tries to start up, hits an early kernel panic, so tries to restart again."

That reframing is the whole section. Each cycle is not another attempt that might work. Each cycle is the same panic, at the same point, followed by the automatic restart that macOS performs after a panic. Left alone, a looping Mac will do this until the battery is flat.

Because the panic is early, it is happening before the parts of macOS that write useful diagnostics are fully up, which is why a boot loop often leaves less evidence behind than a panic that happens after login.

The First Move: Stop the Loop

Howard Oakley's instruction for a boot loop is to hold the power button until the Mac shuts down. Do that first, before anything else. You are not fixing anything by holding the button; you are stopping the machine from repeating a failing operation so that you can control what it tries next.

Then, with the Mac fully off:

1. Wait ten seconds.
2. Press the power button once and let it start normally.

One clean attempt. If it boots, you are through the worst of it, and you should immediately verify a backup and then look at the diagnostics section below to capture evidence while it is fresh. If it loops again, do not try a third time. Go to Safe mode.

Safe Mode as a Diagnostic, Not a Fix

Safe mode is where most post-update problems are diagnosed, and it is misunderstood as a repair tool. It is primarily an experiment.

On an Apple silicon Mac, following Apple's documented procedure: shut down fully, wait about ten seconds, then press and hold the power button until "Loading startup options" appears. Select your startup volume, then press and hold the Shift key while clicking Continue in Safe Mode, and release Shift.

On an Intel Mac: start the Mac and immediately press and hold the Shift key until the login window appears, then log in. You should see "Safe Boot" in the menu bar.

Howard Oakley's advice on what to do once you are in is worth following literally: wait about two minutes, then restart normally. That pause is not superstition. Safe mode runs a directory check, clears certain caches, and does housekeeping that takes time; restarting immediately after the desktop appears cuts that work short.

Here is what the outcome of that experiment tells you:

Safe mode result	What it proves	Reasonable next step
Boots cleanly, normal boot then works	Something in the caches or the startup path was stale, and Safe mode's cleanup cleared it	Nothing further; watch it for a day
Boots cleanly, normal boot still fails	Something loaded only in a normal boot is the cause: a login item, a kernel extension, a system extension, or third-party software	Disable login items and third-party extensions, then test
Will not boot into Safe mode either	The problem is below the layer Safe mode disables, most likely the system, the Preboot volume, or firmware	Recovery, and on Tahoe, Device Recovery Assistant
Boots but a specific feature is broken in both modes	Not a third-party conflict; it is the installed system or a hardware interaction	Reinstall macOS over the top from Recovery

That third row is the important one. A Mac that cannot manage Safe mode has told you something specific, and it saves you from spending an afternoon uninstalling antivirus software that was never the problem.

Failure Mode: Black Screen With a Working Pointer

This one panics people disproportionately, because a black screen reads as dead hardware while a moving pointer reads as a live machine, and the combination feels like the worst of both.

It usually is not dead hardware. A black screen with a responsive pointer after an update generally means the window server is up but the desktop, the Dock, or the login UI has failed to draw. The pointer is drawn by a different mechanism than everything else, which is exactly why it survives.

Work through it in this order:

1. Give it five full minutes. First boots after a major update do a large amount of one-time work, and a slow first login can look identical to a hang.
2. Try to wake the display deliberately: press a key, adjust brightness up several steps, and if you have an external display attached, disconnect it. A display-configuration mismatch after an update is a real and recoverable cause.
3. If nothing changes, force shutdown with a long power-button press, wait ten seconds, and start in Safe mode using the steps above. Safe mode uses a simpler graphics path and frequently gets you to a usable desktop.
4. If Safe mode also gives you a black screen, the problem is not the desktop environment, and you should move to Recovery.

On Intel Macs, resetting NVRAM is a legitimate step for display and startup-selection oddities after an update, because display and startup parameters live there. On Apple silicon, the equivalent user-facing procedures were retired and the machine manages that state itself, so a key combination you remember from an older Mac may simply do nothing on a current one.

Failure Mode: The Mac Boots but Files or Apps Are Missing

This is the failure that generates the most alarm and, very often, the least actual data loss. Howard Oakley's guidance here is to check two specific places before assuming anything is gone.

The Relocated Items Folder

Apple documents this and it is not obscure, but almost nobody encounters it until the day they need it. From Apple's own Mac User Guide: "If any of your files couldn't be moved to their new locations, they're placed in a Relocated Items folder."

Where to look, in Apple's words: "You can find the Relocated Items folder in the Shared folder within the Users folder. An alias to the folder is placed on your Mac desktop." Apple also notes that "The PDF document in the Relocated Items folder explains what to do with files placed in this folder."

In Finder, use Go → Go to Folder and enter:

/Users/Shared/Relocated Items

Or from Terminal:

ls -la "/Users/Shared/Relocated Items"

The folder typically preserves the original directory structure underneath it, so a file that used to be at some path will be at that same path nested inside Relocated Items. That structure is what makes putting things back straightforward rather than a guessing game.

Two things worth knowing. First, items land here because the installer could not move them to a location that the new system's layout expects, which most often affects things installed outside the normal app and library conventions. Second, the desktop alias is easy to dismiss and then forget about; the folder itself persists in /Users/Shared regardless.

The Trash

The other place Howard Oakley points to is the Trash, and it is worth checking before anything more dramatic. Check it before you empty it, which is a sentence that reads as obvious and gets ignored roughly once per major macOS release.

If Both Are Empty

If the file is in neither place and the app genuinely is not in /Applications, then you are into ordinary recovery: reinstall the app from its source, or pull the file from your backup. Time Machine's ability to restore individual items rather than whole systems is the relevant capability here, and it is worth doing that rather than restoring the entire system, which is a far larger operation than a handful of missing files justifies.

Failure Mode: The Mac Boots but Something Is Broken

The Mac starts, you log in, and something specific does not work. Bluetooth will not pair. An external display is not detected. Audio output has no devices. A printer has vanished. An app that worked yesterday quits on launch.

The discipline here is to resist reinstalling immediately, because a reinstall is a large operation that may not touch the actual cause. Run the Safe mode experiment first, using the table above. It costs ten minutes and it partitions the problem space in half.

If Safe mode is clean and normal boot is broken, work through the layers in this order:

1. Login items and background items. System Settings → General → Login Items & Extensions. Disable everything third-party, restart, and test. This is where the largest share of post-update breakage lives, because software that hooks into the system is the software most likely to be invalidated by a system update.
2. System extensions and kernel extensions. Same settings pane, under the extensions section. Virtualization software, VPN clients, backup agents, audio routing utilities, and security software are the usual suspects. A kext or system extension built against an older macOS may load and misbehave rather than fail cleanly.
3. Preference and cache state for the specific broken feature. Narrower and safer than a reinstall.
4. Reinstall macOS over the top. Covered below. This replaces the system without touching your Data volume, and it is the correct move once you have established the problem is not third-party.

If Safe mode shows the same breakage, skip steps one and two entirely. You have already proven third-party software is not responsible, and testing it anyway is wasted effort. Go to step four.

Failure Mode: Repeated Kernel Panics

A kernel panic after an update, especially a repeating one, deserves different handling from a one-off. The distinguishing feature is whether it happens at a reproducible moment.

If the panic happens at a consistent trigger, connecting a specific device, waking from sleep, launching a specific app, plugging in a display, then that trigger is your diagnosis and you should record it precisely. Reproducible panics tied to hardware interaction are often driver or configuration issues rather than a broken installation, and they are worth pursuing before you reinstall anything. We covered a concrete example of that pattern in the writeup on Tahoe 26.5 kernel panics tied to display refresh rate, where the panic log itself pointed at the cause.

If the panics are random, capture diagnostics before you do anything that changes state. Howard Oakley recommends running sysdiagnose for serious problems, and the reason to do it early is that logs roll over. The full procedure is in the diagnostics section below, but the short version is the key chord, Control-Option-Command-Shift-Period, held together.

After you have the diagnostic archive, reinstalling the current macOS version from Recovery is the reasonable next step. Note the honest caveat, in Howard Oakley's words: "the incomplete or broken updates of the past simply can't happen with an SSV, which is guaranteed to be perfect as Apple intended." A reinstall gives you a known-good system, which is genuinely useful, but if the system was already verifiably correct, it may not be the thing that was wrong. That is a real limitation of the reinstall step and it is better to know it going in than to be surprised by it afterwards.

Broader startup failures that are not specifically update-related have their own decision tree, and our complete Mac startup troubleshooting guide covers the symptoms that look similar but have different causes, such as a Mac that never reaches the Apple logo at all.

Device Recovery Assistant: Tahoe's New First Responder

macOS Tahoe introduced a genuinely new piece of recovery machinery, and because it appeared quietly it is still unfamiliar to most people who need it.

What It Is

Apple describes Recovery Assistant as a utility designed to open automatically when your Mac has an issue that prevents startup, which then attempts to identify the issue and resolve it. In Apple's own interface wording, it tells you that this Mac encountered an issue while starting, and that the recovery process looks for any problems and attempts to resolve them if found.

Howard Oakley covered it when it arrived, in "New in Tahoe Recovery: Device Recovery Assistant" on 26 September 2025, and he flags a naming trap that is worth understanding before you go looking for it. There are two different things in Recovery that carry similar names. The assistant you meet when you click Options at the startup options screen, which asks you to select a user and authenticate, is one thing. The tool in the Utilities menu, whose own application menu identifies it as Device Recovery Assistant, is a separate tool. They are not the same, despite the shared name, and looking for one while reading instructions about the other is a reliable way to waste twenty minutes.

Howard Oakley also notes, candidly, that Apple's support documentation "doesn't give any further information about what DRA does." That is worth stating plainly: Apple has documented the outcomes and the requirements but has not published what remediations Device Recovery Assistant actually applies. Anyone telling you exactly what it repairs is inferring.

How to Launch It Manually

You do not have to wait for it to trigger itself. Start up in Recovery, then use the Recovery Assistant command in the Utilities menu.

The route on an Apple silicon Mac is: shut down fully, press and hold the power button until "Loading startup options" appears, click Options, click Continue, authenticate as an administrator, and then choose Recovery Assistant from the Utilities menu in the menu bar.

The Network Requirement, and Where It Bites

Apple documents that Recovery Assistant needs an internet connection to download the latest details about software issues that might affect your Mac, and that you should select a Wi-Fi network if prompted. This is the architectural point: the tool is not shipping fixed repair logic inside your Recovery volume. It fetches current remediation information from Apple at the time you run it, which is what allows Apple to respond to a bad update after that update has already shipped.

The corollary is a limitation that catches people at exactly the wrong moment. Apple's documentation states that captive networks and networks requiring 802.1X authentication are not supported in macOS Recovery. That covers hotel Wi-Fi, airport Wi-Fi, most coffee shop networks, university networks, and a large share of corporate wireless. If your Mac will not boot and you are on any of those, Device Recovery Assistant cannot do the thing it exists to do.

Plan accordingly: use a home network with ordinary WPA2 or WPA3 security, use wired Ethernet, or use a personal hotspot from your phone, which presents as an ordinary WPA-secured network rather than a captive portal.

The Three Outcomes

Apple documents three possible results. In plain terms: it recovered your Mac successfully, it was unable to recover your Mac, or no known issues were found. You then click Restart Mac. Apple also notes that if startup then succeeds you may see a notification about recovering iCloud data.

What each result should mean to you:

Result	Interpretation	Next step
Recovered successfully	Apple had a known remediation for a condition present on your Mac and applied it	Restart, then verify the specific thing that was broken
No known issues found	Your symptom is not one Apple currently has remediation logic for. This is not the same as "your Mac is fine"	Continue down the playbook: Safe mode, then reinstall from Recovery
Unable to recover	It identified something and could not fix it	Capture diagnostics, then reinstall; be ready to escalate

The middle result is the one most likely to be misread. "No known issues found" is a statement about Apple's current remediation database, not a clean bill of health for your machine.

macOS Recovery: Getting In, and What Is Inside

Recovery is the environment where most real repairs happen. Getting into it works completely differently on the two architectures, and using the wrong procedure is one of the most common reasons people conclude their Mac is beyond help when it is not.

Apple Silicon

Apple's documented procedure is to press and hold the power button until "Loading startup options" appears, then release it. You will get the startup options screen showing your startup disks and a gear icon labelled Options. Click Options, then click Continue.

The details that matter: the Mac must be fully shut down first, not asleep and not restarting. You hold the button continuously through the whole startup rather than tapping it. And you keep holding past the point where it feels like something should have happened, because the text appears later than instinct suggests.

That same startup options screen is the gateway to several things beyond Recovery: choosing a different startup disk, and, with the Shift key held while clicking Continue, Safe mode.

Intel

On an Intel Mac, press and release the power button to turn the Mac on, then immediately press and hold Command-R. Keep holding until you see the Apple logo or a spinning globe.

Two variants exist on Intel, and they behave differently:

Key combination	What it starts	When to use it
Command-R	The Recovery on your local disk	Default choice; reinstalls the version currently or most recently installed
Option-Command-R	Internet Recovery	Local Recovery is damaged or missing
Shift-Option-Command-R	Internet Recovery, older-version behaviour	When you specifically need the version that shipped with the Mac, or the closest still available

The spinning globe means the Mac has fallen back to network recovery, which requires a working network and takes considerably longer, because it downloads the recovery environment before it can do anything.

Fallback Recovery on Apple Silicon

Apple silicon Macs keep more than one recovery environment. Howard Oakley describes Fallback Recovery as a second copy of recoveryOS preserved for resilience, and it is reachable when the primary Recovery is broken.

The entry method is a specific rhythm. From a fully shut-down Mac, press the power button once, then immediately press it again and hold the second press until the display shows that options are loading. Howard Oakley describes the cadence as being like the Morse "di-da," with no more than about a second between the two presses. It takes a couple of attempts to get the timing right, and getting it wrong just gives you a normal startup or normal Recovery, so it is safe to retry.

What you get is a Recovery environment that is typically an older version than your current system, with the capabilities of that older version. Howard Oakley notes one specific limitation: Startup Security Utility does not work in Fallback Recovery, so you cannot change security policy from there. Newer tools, including Device Recovery Assistant, may not be present either, since Fallback predates them.

Use Fallback when primary Recovery will not start. It is the step between Recovery failing and DFU, and reaching for it before DFU can save you an erase.

What Each Utility Is For

Utility	What it does	When it is the right tool
Recovery Assistant	Fetches current remediation information from Apple and attempts an automated repair	First stop on Tahoe when the Mac will not start and you have a usable network
Reinstall macOS	Reinstalls the system onto your existing volume group	System is suspect; your data stays in place
Restore From Time Machine	Restores a whole system from a Time Machine backup	You have decided to go back to a known-good state wholesale
Disk Utility	First Aid on volumes and containers; also where erasing happens	Suspected filesystem problems; be careful with the erase button
Safari / web browser	Reading documentation while the Mac is down	Looking up a specific error before acting
Terminal	Runs as root in the Recovery environment	Targeted commands when you know exactly what you are doing
Startup Security Utility	Boot security policy	Rarely needed for update recovery; not available in Fallback Recovery
Share Disk	Presents the internal disk to another Mac over a cable	Getting data off a Mac that will not boot

Share Disk deserves a specific mention in the context of a failed update, because it is the answer to the worst version of the backup question. If the Mac will not boot and your backup is old, Share Disk lets another Mac mount this Mac's Data volume and copy files off before you attempt anything destructive. Doing that first converts a potential disaster into an inconvenience.

Reinstalling macOS Without Erasing

This is the step people are most afraid of, and it is the step that is least likely to hurt them. Reinstalling macOS from Recovery installs a fresh copy of the system onto your existing volume group. Your Data volume, your home folder, your applications, and your settings are not the target of the operation.

The procedure:

1. Start up in Recovery using the architecture-appropriate method above.
2. Choose Reinstall macOS and click Continue.
3. When asked where to install, select your existing startup volume. This is the step that matters. Selecting your existing volume is what makes this a reinstall rather than a clean install.
4. Let it run. It will restart one or more times, and it will take a while, and the progress estimate will be no more honest than it was during the original update.

Three things to know before you start:

It needs the network. The installer downloads the system. On a slow connection this can take considerably longer than the install itself, and the captive-portal and 802.1X limitation applies here too.

It installs a specific version. On Apple silicon, reinstalling from Recovery installs the version associated with that Recovery environment. It is not a mechanism for choosing which macOS version you get.

It may not fix your problem. Worth repeating Howard Oakley's point: with an SSV, the system you already had was cryptographically verified to be exactly what Apple shipped. If the system was already correct, replacing it with an identical correct copy changes nothing. Reinstalling is still worth doing because it also refreshes the Preboot volume and the boot path, which are not sealed and can be the actual problem. But go in with calibrated expectations rather than treating it as a guaranteed fix.

Reverting to the Previous Version

This is the last resort before contacting Apple, and the costs are different on each architecture. Read this section before you start, not partway through.

Apple Silicon: Say the Cost Out Loud First

Reverting an Apple silicon Mac to an earlier version of macOS erases the Mac. There is no supported in-place downgrade. Apple's own description of a DFU restore is that it updates the firmware, updates recoveryOS to the latest version, and erases and installs macOS on your internal storage, with any data on any internal volumes becoming unrecoverable.

"Unrecoverable" is Apple's word, and it is accurate. This is not a delete that a recovery tool can undo, because the storage is encrypted at the hardware level and the restore effectively discards the keys along with the data.

So the sequence is: verified backup, then revert. Not the other way around. If you do not have a backup you trust, use Share Disk or Safe mode to make one before you go any further, even if that takes a day.

Revive Versus Restore: The Distinction That Matters Most

Apple Configurator's DFU operations come in two forms, and confusing them is the single most expensive mistake available in this entire article.

Operation	Firmware	recoveryOS	Startup volume	Your data
Revive	Updated	Updated to latest	Designed not to be changed	Preserved
Restore	Updated	Updated to latest	Erased and reinstalled	Erased, unrecoverable

Apple describes a revive as updating the firmware and updating recoveryOS to the latest version while being designed not to make any changes to the startup volume, the user's data volume, or any other volumes. Howard Oakley's summary is that a revive installs fresh firmware and Recovery while leaving the macOS container untouched, whereas a restore erases the whole internal SSD and then installs firmware, Recovery, and macOS containers.

The practical rule that follows: always try a revive first. It is faster, it is non-destructive, and for a Mac bricked by a firmware problem during an update it is frequently sufficient. Only escalate to a restore when a revive has not helped and you have a backup you have verified.

How a DFU Operation Works

You need a second Mac. The failed Mac becomes the target, the working Mac drives the operation.

What is required: a working Mac, a USB-C cable capable of carrying data and power, and either Apple Configurator 2 or, on recent macOS versions, the Finder on the host Mac. Howard Oakley notes that the DFU connection runs over USB rather than Thunderbolt, so a cable and port that only do one of those will not work. Which port on the target Mac accepts a DFU connection varies by model, and Apple's own documentation specifies it per model, so check yours rather than assuming.

The target Mac must be put into DFU mode using a model-specific power button sequence. That sequence differs between laptops and desktops and between generations, and it is not something to guess at. Apple's "How to revive or restore Mac firmware" support article documents the current procedure per model, and that is the source to use.

Choosing Which Version You Get

A restore installs an IPSW file, and by default that is the latest one. To land on an older macOS version you have to supply an older IPSW, which in Apple Configurator 2 means dragging the IPSW file onto the DFU target rather than accepting the default.

The constraint that people discover too late: Apple has to still be signing that IPSW. Practitioners who track this, notably Mr. Macintosh, who maintains a public database of Apple silicon restore images, document that Apple stops signing older releases and typically leaves only a narrow window during which the previous version remains restorable. Apple does not publish a signing schedule or commit to a window length, so treat any specific number of days you read as an observation of past behaviour rather than a guarantee.

The consequence is a deadline you cannot control: the option to revert to the version you were happy with expires, quietly, on Apple's timetable. If you are seriously considering reverting, that decision has a clock on it.

If you are weighing this specifically as a downgrade rather than as emergency recovery, our step-by-step guide to downgrading from Tahoe to Sequoia walks the whole path including the backup and restore stages on either side of the erase.

Intel: The Firmware Ceiling

Intel Macs have a limitation with no workaround. Howard Oakley states it directly: "Intel Macs have one significant limitation here: firmware...you can't return an Intel Mac's firmware to a previous version."

This matters because a macOS update on an Intel Mac can update the firmware as well as the operating system. If the problem you are trying to escape lives in the firmware, reverting macOS does not take the firmware with it. You can install an older macOS, but you will be running it on top of the newer firmware, and if that combination is the problem, you have not solved it.

There is no user-accessible way around this. It is a genuine dead end and the correct response is to escalate to Apple rather than to keep trying variations.

Collecting Diagnostics Before You Call Apple

If you are going to contact Apple Support, or if you want any chance of understanding what happened afterwards, capture a sysdiagnose before you start changing things. Logs roll over. The evidence from the failure is perishable.

What sysdiagnose Is

The man page on macOS describes it exactly: "sysdiagnose – gathers system-wide diagnostic information helpful in investigating system performance issues."

On its output and operation, the man page says: "The data is stored /var/tmp directory. sysdiagnose needs to be run as root. To cancel an in-flight sysdiagnose triggered via command line interface, press Ctrl-\."

The Key Chord

The man page states: "sysdiagnose is automatically triggered when the following key chord is pressed: Control-Option-Command-Shift-Period."

Press all five together. You will hear a short sound and the display will flash briefly, and then the Mac will work for a few minutes while it gathers everything. It is the same set of keys people write in several different orders. Apple's man page orders them Control-Option-Command-Shift-Period; Howard Oakley writes them as Command-Option-Control-Shift-period. Same keys, same result. The order in which you name them makes no difference; the fact that all five plus the period key are held simultaneously does.

This is the method to use when the Mac is limping, because it needs no Terminal and no typing.

From Terminal

sudo sysdiagnose

It needs root, as the man page states. If you want the archive somewhere easier to find than /var/tmp, the -f option specifies the results directory:

sudo sysdiagnose -f ~/Documents

Howard Oakley suggests exactly that form for this situation, and it is a practical improvement because /var/tmp is not somewhere most people can navigate to comfortably in Finder.

From Activity Monitor

Howard Oakley also points to Activity Monitor's System Diagnostics option, which is useful when you would rather click than type and the Mac is running well enough to open an app.

What Ends Up in the Archive

The man page enumerates it. Among other things, sysdiagnose collects a spindump of the system, several seconds of top output, data about kernel zones, the status of loaded kernel extensions, resident memory usage of user processes, recent system logs, a System Profiler report, recent crash reports, disk usage information, I/O Kit registry information, and network status.

Three of those are directly relevant to a failed update. The status of loaded kernel extensions tells you what third-party code was in the kernel. Recent crash reports capture the panic. And recent system logs contain the update's own trail, which is where the actual cause usually is.

One honest caveat: a sysdiagnose archive contains a great deal of information about your Mac and what has been running on it. Treat it as sensitive. It is intended to be handed to Apple, not posted publicly.

Preventing the Next One

Most of what follows is unglamorous, and all of it is cheaper than the playbook above.

Verify the Backup, Do Not Just Have One

A backup that has never been restored from is a hypothesis. Before a major update, restore something from it. One file is enough to prove the chain works end to end: the disk mounts, the backup is readable, and a restore actually produces a file.

Check the date of the most recent completed backup, not the schedule. Check that the destination has room. If your backup drive has been quietly failing to complete for three weeks, the update is not the moment you want to discover that.

Free Space

Updates need substantially more free space than the download size, because the installer needs room to stage, expand, and verify content, and because APFS snapshots consume space during the process. The number the installer quotes is a floor, not a comfortable target. Going in with a healthy margin above whatever it asks for prevents a whole family of mid-update failures.

Do Not Update on the Day of Release

There is nothing on the other side of a same-day update that is worth being in the first wave for. Waiting a week costs you nothing and lets other people find the model-specific problems. This is the single highest-value habit in this entire article and it requires no technical skill whatsoever.

Check for Known Issues First

Before you click Update, spend five minutes checking whether anyone is reporting a problem with your specific model or your specific critical software. That is a different question from whether the update is generally fine.

Update at the Right Moment, on the Right Power

Plug in. Do not start an update on battery, do not start one when you need the machine in an hour, and do not start one over a connection you do not control. Give the process the conditions it needs to finish without being interrupted, because the recovery from an interruption is the rest of this article.

macOS 27 Golden Gate Is Nearly Here

This is worth planning for now. Apple seeded macOS 27 Golden Gate developer beta 5 to developers on 10 August 2026, carrying build number 26A5406e, and coverage of that beta describes it as keeping a September launch on track. Apple has not published a release date, so September remains an expectation rather than a commitment.

What that means for you: a large wave of people are going to install a brand-new major version within weeks, and major-version upgrades are where the failure modes in this article are most likely to appear. Everything above about backups, free space, and not going first applies with more force to a major upgrade than to a point release.

If you are considering the beta rather than waiting for the release, treat that as a separate decision with its own risk profile. Our writeup on whether to install the macOS 27 Golden Gate developer beta covers the known issues and, more usefully, the question of what hardware you should be running it on.

Troubleshooting Common Issues

The Mac Restarts Into the Installer Over and Over

Problem: After forcing a shutdown of a stalled update, the Mac starts back into the installer rather than into macOS, repeatedly.

Solution: This is usually the installer correctly resuming, and the right response is to let it. Give it a full cycle without interruption, plugged in. If it genuinely loops without progressing, stop it with a long power-button press, then start in Recovery and use Reinstall macOS, selecting your existing volume. That replaces the ambiguous state with a definite one. Do not erase anything at this stage.

Recovery Will Not Start on an Apple Silicon Mac

Problem: Holding the power button produces a normal startup attempt or nothing at all, and "Loading startup options" never appears.

Solution: The Mac must be fully shut down first, not asleep. Hold the button continuously from a cold start and keep holding well past the point where the screen lights up. If the primary Recovery is genuinely damaged, use Fallback Recovery: press the power button once, immediately press again and hold the second press until options load, with under a second between presses. If neither works, the next step is a DFU revive from a second Mac, which is non-destructive.

Recovery Assistant Says It Cannot Connect

Problem: Device Recovery Assistant asks for a network and then cannot reach Apple.

Solution: Apple documents that captive networks and networks requiring 802.1X are not supported in macOS Recovery. Hotel, airport, campus, and most corporate wireless fall into one of those categories. Use a home network with ordinary WPA2/WPA3 security, use wired Ethernet, or start a personal hotspot on your phone. There is no setting inside Recovery that works around a captive portal.

The Update Finished but a Third-Party App Now Crashes on Launch

Problem: Everything works except one application, which quits immediately.

Solution: Check the vendor's compatibility statement for your macOS version before doing anything to the system, because the fix is very often a vendor update rather than anything on your end. If the app installs a system extension or kernel extension, check System Settings → General → Login Items & Extensions to see whether it is being blocked. Reinstalling macOS will not fix an app that has not been updated for the new system.

Files Are Missing and Relocated Items Is Empty

Problem: You checked /Users/Shared/Relocated Items and the Trash, and what you are looking for is in neither.

Solution: Confirm you are logged into the account that owned the files, since a post-update login into a different or newly created account is a surprisingly common cause of "everything is gone." Use Spotlight to search for a distinctive filename including system locations. If the files genuinely are not present, restore them individually from your backup rather than restoring the whole system, which is a much larger operation than the problem requires.

A Kernel Panic Happens Every Time You Wake the Mac From Sleep

Problem: The Mac is stable while awake but panics on wake.

Solution: This is a reproducible trigger, which makes it far more tractable than a random panic. Capture a sysdiagnose right after a panic so the crash report is in the archive. Then test in Safe mode: if wake is stable there, the cause is third-party, and the candidates are drivers for external devices, virtualization software, and anything that installs a kernel or system extension. Disconnect all peripherals and test again to isolate hardware interaction.

Disk Utility Reports Errors It Cannot Repair

Problem: First Aid in Recovery finds problems on a volume and fails to fix them.

Solution: Run First Aid on the container as well as the individual volume, since container-level problems present as volume-level symptoms. Do not repeatedly re-run a failing repair; each attempt on a struggling disk carries risk. If First Aid cannot repair the container, prioritise getting data off the machine using Share Disk or a backup before doing anything else, and treat unrepairable filesystem errors on an internal SSD as a reason to involve Apple rather than to keep trying tools.

The Mac Boots but macOS Reports the Wrong Version

Problem: After a failed or interrupted update, System Settings shows a version you did not expect.

Solution: This is generally benign and means the update did not complete and the Mac fell back to its previous system, which is the design working correctly. Confirm free space, confirm the backup, then retry the update from System Settings → General → Software Update. If it fails the same way twice, capture a sysdiagnose after the second failure so the pattern is in the logs before you retry a third time.

FAQ

Is it safe to force shut down a Mac during a macOS update?

It is not the first thing to try, but it is not the catastrophe it once was. Howard Oakley notes that for almost the whole duration of an update, the Data volume with your files is unmounted, so a forced shutdown mostly risks an incomplete system rather than damaged documents. Wait first, well past your patience threshold, and use a long power-button press rather than pulling power.

How long should a stuck macOS update progress bar be given before acting?

Longer than feels reasonable. Howard Oakley documented an apparent freeze at 98.6% that lasted twelve minutes and seven seconds with preparation continuing throughout, and notes slower Macs can take 30 minutes or more. Judge by heat, fan noise, and whether anything on screen has changed in the past twenty minutes, rather than by the number on the bar.

Does reinstalling macOS from Recovery erase my files?

No. Reinstalling onto your existing volume group replaces the system while leaving your Data volume in place, so your home folder, apps, and settings survive. The step that matters is selecting your existing startup volume when the installer asks where to install. Erasing is a separate, clearly labelled operation in Disk Utility that you have to choose deliberately.

What is the difference between revive and restore in DFU mode?

Apple describes a revive as updating firmware and recoveryOS while being designed not to change the startup volume, the user's data volume, or any other volumes. A restore updates firmware and recoveryOS, then erases and installs macOS, with data on internal volumes becoming unrecoverable. Always attempt a revive first; it is non-destructive and often sufficient.

Why does Recovery Assistant need an internet connection?

Because it does not carry its repair logic locally. Apple documents that it needs a connection to download the latest details about software issues that might affect your Mac, which is how Apple can respond to problems discovered after an update shipped. Apple also documents that captive networks and 802.1X networks are not supported in macOS Recovery, so plan for an ordinary WPA-secured network.

Can I downgrade an Apple silicon Mac without losing data?

Not through any supported path. Reverting to an earlier macOS version on Apple silicon goes through a DFU restore, which Apple describes as erasing and installing macOS with internal volume data becoming unrecoverable. The only way to keep your data is to restore it from a backup afterwards, which makes a verified backup the precondition rather than an optional precaution.

Conclusion

The reason a failed macOS update feels so much worse than it usually is comes down to a mismatch between what the screen shows you and what the machine is doing. A stationary progress bar looks like a dead Mac and is usually a busy one. A boot loop looks like a machine trying its best and is actually a machine repeating the same early kernel panic. And a Mac that boots without your files looks like data loss when the files are frequently sitting in /Users/Shared/Relocated Items, exactly where Apple documents they will be.

The sealed system volume is the thread running through all of it. Because the system is cryptographically verified down to the last bit, as Howard Oakley puts it, the old mushy half-broken failures are gone, replaced by cleaner binary ones. Because your Data volume is unmounted for most of an update, an interruption threatens the system far more than it threatens your work. And because the recovery tools that can definitively fix an Apple silicon Mac include one that erases it, the value of a verified backup is not spread evenly across the playbook; it is concentrated entirely at the end, where it decides whether the last resort is available to you at all.

If you take three things away: wait longer than you want to before forcing a shutdown, stop a boot loop rather than letting it run, and try a revive before a restore. If you are about to update, especially with macOS 27 Golden Gate expected in September, spend ten minutes today restoring one file from your backup to prove the backup works. That ten minutes is what turns every scenario in this article from a crisis into an inconvenience.

Related reading: Mac startup problems: complete troubleshooting guide · The best Mac backup strategy for 2026