Understanding partitions;Fear of tampering

Question

Level 1

4 points

Understanding partitions;Fear of tampering

Im reformating my macbook and trying to do a factory reset.

This process has been wiping my hard drive-> reinstalling monterey.

I just want to understand my drives and make sure and malicious tampering is not in play. Ive had my system accessed once physically and it has been slowed down/strange ever since.

Im not paranoid to say that i might have some complex efi bootkit. But id rather be safe than sorry:

1)I have an apple disk image, which holds the mac os base system. Clearly i cant format this partition. However just want to check if it is sound:

(Location:External)

2) My HD partition has a constant undeclared ‘Other Volumes’ partition that generates everytime i erase the drive. This takes up 146mb always on the dot. Under the container header this partition is defined as ‘3 not mounted’ volumes. In the sub headers, my Macintosh HD and Data, this value is listed as ‘Other Volumes’.

Are these normal file systems that are installed every time the drive is erased, or is something amiss?

All in all, i would prefer to wipe my physically drive completely, and use the firmware internet OS recovery to reinstall my system

I cannot format my physical disk(SSD) from the recovery-> disk utility tool. So otherwise, how can i do clear my whole drive completely. Is this only possible through single user mode/command line?

I understand cleaning out the physical drive is not a risk ad mac’s built in EFI will automatically download an internet recovery tool.

Posted on Dec 3, 2021 7:18 PM

Reply

Answer 1

Best reply

Barney-15E

Level 10

112,818 points

Dec 3, 2021 8:04 PM in response to nas178

1) That’s the Recovery/installer OS. There is nothing you can do with it.

2) You are not really seeing partitions. The APFS file system has Containers that hold Volumes. Containers are similar to partitions. Volumes are virtual sub-structures that are separate from one-another, but all share the space allocated to the container.

The main volumes are

Macintosh HD — OS
- Data — your data and third-party software
VM — virtual memory (swap space for RAM)
Preboot — boot stuff
Update — storage space for staging updates.
Recovery — About macOS Recovery on Intel-based Mac computers - Apple Support

If you select one of them, all the rest are other volumes in the container.

All of them are normal parts of Big Sur and Monterey. The do not exist until you install the OS. In addition, the OS is booted from a secure, sealed snapshot of the OS volume. Pretty much nothing can alter the OS.

All in all, i would prefer to wipe my physically drive completely, and use the firmware internet OS recovery to reinstall my system

You can do that by booting into Internet Recovery, and in Disk Utility, select Show All Devices from the View popup menu. Select the drive device and Erase. This is not a good idea on Apple Silicon (M1) Macs. Important information is stored on the drive and if you erase that, you will have to use another Mac to fix it.

I cannot format my physical disk(SSD) from the recovery-> disk utility tool. So otherwise, how can i do clear my whole drive completely. Is this only possible through single user mode/command line?

Sure you can. See above.

I understand cleaning out the physical drive is not a risk ad mac’s built in EFI will automatically download an internet recovery tool.

On an M1, it is a risk. On Intel, you can recover from Apple’s servers, but that sometimes fails. It is better to create a bootable USB Installer.

Reply

Understanding partitions;Fear of tampering

Similar questions