There might be the need to fetch some files which contain firmware from the recovery OS partition, without booting into macOS.
Fortunately, we can mount APFS volumes read-only on Linux using apfs-fuse.
- Install apfs-fuse from https://github.com/sgan81/apfs-fuse (follow README.md)
- Create mountpoint for recovery volume and recovery OS:
$ sudo mkdir /mnt/macos_recovery /mnt/macos_recovery_base
- Get partition ID of recovery OS:
$ sudo parted /dev/nvme0n1 print
Model: APPLE SSD AP1024Z (nvme)
Disk /dev/nvme0n1: 1001GB
Sector size (logical/physical): 4096B/4096B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
1 24.6kB 524MB 524MB iBootSystemContainer
2 524MB 104GB 103GB Container
3 104GB 106GB 2500MB
4 106GB 107GB 500MB fat32 boot, esp
5 107GB 178GB 71.2GB ext4
6 178GB 186GB 7999MB
7 186GB 995GB 809GB
8 995GB 1001GB 5369MB RecoveryOSContainer
/dev/nvme0n1p8 contains the recovery OS
- Get volumne ID of revovery OS:
$ sudo ./apfsutil /dev/nvme0n1p8
Volume 0 AB2E78ED-A2C3-4A5E-86F3-XXXXXXXXXXXX
---------------------------------------------
Role: Recovery
Name: Recovery (Case-insensitive)
Capacity Consumed: 789880832 Bytes
FileVault: No
Snapshots:
27 : 'com.apple.os.update-MSUPrepareUpdate'
Volume 1 90A1160E-1599-4084-8253-XXXXXXXXXXXX
---------------------------------------------
Role: Update
Name: Update (Case-insensitive)
Capacity Consumed: 28672 Bytes
FileVault: No
Snapshots:
Volume 0 contains the recovery OS
- Mount recovery OS volume:
$ sudo ./apfs-fuse -o allow_other /dev/nvme0n1p8 /mnt/macos_recovery
- Locate recovery OS base image:
$ ls -lh /mnt/macos/root/3D3287DE-280D-4619-AAAB-XXXXXXXXXXXX/boot/DE46A95A1728513B090F8135841CCFBB324C94445632466B5C74F73634DB567975968FCB14E2E9C048CXXXXXXXXXXXX/usr/standalone/firmware/
total 0
drwxrwxrwx 1 root root 14 Mar 22 2023 FUD
-rw-rw-rw- 1 root root 1.7G Mar 22 2023 arm64eBaseSystem.dmg
-rw-rw-rw- 1 root root 11K Mar 22 2023 base_system_root_hash.img4
-rw-rw-rw- 1 root root 61K Mar 22 2023 devicetree.img4
-rw-rw-rw- 1 root root 847K Mar 22 2023 iBoot.img4
-rw-rw-rw- 1 root root 11K Mar 22 2023 root_hash.img4
-rw-rw-rw- 1 root root 6.0M Mar 22 2023 sep-firmware.img4
arm64eBaseSystem.dmg contains the system files of recovery OS
- Mount base image:
$ sudo ./apfs-fuse -o allow_other /mnt/macos/root/3D3287DE-280D-4619-AAAB-XXXXXXXXXXXX/boot/DE46A95A1728513B090F8135841CCFBB324C94445632466B5C74F73634DB567975968FCB14E2E9C048CXXXXXXXXXXXX/usr/standalone/firmware/arm64eBaseSystem.dmg /mnt/macos_recovery_base
- Access files from base image:
$ ls -lh /mnt/macos_recovery_base/root/
total 0
drwxrwxr-x 1 root 80 3 Feb 9 2023 Applications
drwxr-xr-x 1 root root 1 Feb 9 2023 'Install macOS Ventura.app'
lrwxr-xr-x 1 root 80 0 Feb 9 2023 Library -> System/Volumes/Data/Library
drwxr-xr-x 1 root 80 8 Feb 9 2023 System
lrwxr-xr-x 1 root 80 0 Feb 9 2023 Users -> System/Volumes/Data/Users
drwxr-xr-x 1 root root 0 Feb 9 2023 Volumes
drwxr-xr-x 1 root root 33 Feb 9 2023 bin
lrwxr-xr-x 1 root 80 0 Feb 9 2023 cores -> System/Volumes/Data/cores
dr-xr-xr-x 1 root root 0 Feb 9 2023 dev
lrwxr-xr-x 1 root root 0 Feb 9 2023 etc -> private/etc
lrwxr-xr-x 1 root 80 0 Feb 9 2023 opt -> System/Volumes/Data/opt
lrwxr-xr-x 1 root 80 0 Feb 9 2023 private -> System/Volumes/Data/private
drwxr-xr-x 1 root root 61 Feb 9 2023 sbin
lrwxr-xr-x 1 root root 0 Feb 9 2023 tmp -> private/tmp
drwxr-xr-x 1 root 80 6 Feb 9 2023 usr
lrwxr-xr-x 1 root root 0 Feb 9 2023 var -> private/var
- Get for example /usr/sbin/appleh13camerad which contains camera calibration files:
$ cp /mnt/macos_recovery_base/root/usr/sbin/appleh13camerad ~/
- Umount base image and recovery OS volume:
$ sudo umount /mnt/macos_recovery_base /mnt/macos_recovery