ejbpesca wrote:
Revive, restore, recovery. I am not sure which one of these I am after to have standing by on a USB drive in case I would like to take my MacBook Air Monterey 12.5 back to a state as if it were out of the box, install the OS and then install my files. Which of these does that by erasing the OS and my files so I may begin again with a virus free, uncorrupted file, computer?
There's several methods for erasing an Apple silicon Mac. I've listed them below.
For context, in macOS Big Sur and later (the earliest version that supports Apple silicon), macOS uses a System volume and a Data volume. The vast majority of macOS is stored in the System volume as a sealed, immutable snapshot. Everything else, including all of your files, settings, and third-party apps, are stored in the Data volume.
Additionally, Apple silicon Macs use a different system infrastructure than Intel-based Macs. Apple silicon Macs require two system partitions to always be present; otherwise the boot process will fail. The first partition (of type Apple_APFS_ISC) holds Secure Boot policies, system activation data, and the Secure Enclave storage. The second partition (last on the map, of type Apple_APFS_Recovery) holds a backup copy of macOS Recovery.
- Erase All Content and Settings (inside System Preferences): This method destroys the existing Data volume and creates a new one. All other volumes and partitions (except the two system partitions) are removed. The existing System volume (and thus macOS) survive the erase, but the Mac is nonetheless now in a factory state. Apple recommends this method above all others.
- Recovery Assistant in macOS Recovery: If your Mac has FileVault or Find My Mac enabled, Recovery Assistant will appear when you start up in macOS Recovery. You can also invoke it by running "resetpassword" in macOS Recovery's Terminal. Although it mainly requests authentication and deals with system activation, it also has a hidden option to erase your Mac (in the top menu bar, if you click on Recovery Assistant -> Erase Mac). This method destroys all partitions, except for the two system partitions, and creates a new APFS container with an empty volume. You must reinstall macOS after the erase.
- Disk Utility in macOS Recovery: This method only destroys what you choose to destroy. I usually discourage this method on newer Macs since it is easy to miss some important steps if you want to completely erase the Mac. To completely erase the Mac (except for the two system partitions), open Disk Utility, select View -> Show All Devices, select the top level of the internal drive and click Erase. Name it "Macintosh HD", format as APFS, and choose the GUID Partition Map for the scheme. Then, follow the onscreen instructions. (This might not work in early versions of macOS Big Sur's Recovery.) You must reinstall macOS afterwards.
- Firmware restore: This method is the most comprehensive out of all of them, but it requires another Mac running Apple Configurator. All data, including the system partitions, is destroyed. Then, system firmware is reinstalled, and the internal drive is reimaged using the firmware restore file delivered by the other Mac. When done, you'll need to activate your Mac, and then it will boot into a fresh copy of macOS. Given the right cables and Internet, this is guaranteed to succeed every time. (This behaviour is only for Apple silicon Macs, including yours.)
NOTE: In regards to a firmware revive, that reinstalls the firmware and the backup copy of macOS Recovery, but it doesn't erase any data.
Out of all of these methods, none of them can actually be put onto a USB drive. Yes, you can create a bootable installer (which contains macOS Recovery), but your Mac won't actually start up from it. Instead, it will start up from an internal copy of macOS Recovery, and only leverage your bootable installer when you choose to reinstall macOS. Basically, it will speed up installing macOS, but nothing else.
TL;DR: None of them can be used on a USB drive, but Erase All Content and Settings is the best option. Second best is a firmware restore, or Recovery Assistant.