0

How can I confirm the files and folders visible in macos base system (seen via disk utility when booting into recovery (CMD r)) are standard? Attached are photos of part of it. Any help appreciated. [screenshotscreenshot 2

5
  • 2
    Do you suspect that your Recovery partition has been compromised in some way?
    – benwiggy
    Commented Feb 15 at 13:40
  • Yes I do. There are a large number of folders and files under "developer" within "library" including in 3 sub-folders which are 6-8 layers down, 999 private frameworks, 198 frameworks and 66 frameworks. There is not any apps that explain this with MS Office being the only material app installed Commented Feb 15 at 14:40
  • I don't think that is unexpected. How big is the Recovery Volume? You could erase the recovery partition, and re-install it, if you really suspect that something has compromised it; though I would first research whether any such behaviour is known, and consider whether you have evidence/just suspicion of tampering.
    – benwiggy
    Commented Feb 15 at 14:59
  • In fact, I'd be surprised if the Recovery volume wasn't signed like the main OS volume.
    – benwiggy
    Commented Feb 15 at 15:04
  • I do have evidence of a 3rd party tampering. The recovery volume is 1.57GB. It does not seem possible to delete it and where is a clean version available from? Commented Feb 15 at 15:08

2 Answers 2

0

If you don't trust the content of the Recovery Partition, you can download a fresh installation image for the OS itself directly from Apple (see the answer to How can I download an older version of OS X/macOS? for details). It won't update the Recovery Partition itself though, so if you have reason to be concerned about its state, getting a new Mac might be the safer approach.

4
  • Are you saying that reinstalling the OS will update the Recovery partition? I can't see anything on that link about re-installing the recovery.
    – benwiggy
    Commented Feb 15 at 14:19
  • @benwiggy No, I don't, I clarified that now. Thanks for pointing it out.
    – nohillside
    Commented Feb 15 at 14:25
  • I have reinstalled Macos several times and believe the the recovery partition has been changed. Commented Feb 15 at 14:34
  • The base system has been interfered with by a third party and after the installing the OS again without any connection outside the installer issues demonstrating this occurred. The question is how to identify what should and should not be part of the base system. Commented Feb 19 at 15:44
0

Download the OS installer app, run it, and you should be able to enter Disk Utility there, erase the entire system device, and then reinstall the OS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .