I had my Macbook Air for about 3 years now and it has been as reliable as rain in April. I never had any major problems with it, even going through updates from El Capitan, Sierra and High Sierra (I did not upgrade to Mojave yet). So to my horror, this was what I saw when I powered up a few days ago.

Problem

It just stuck there, at boot. The progress bar was moving, but it eventually stops, about 15 minutes later. With a SSD, it normally takes less than a minute for the bar to fill and bring me to the desktop. I gave it another few minutes, power cycled, and the same thing happened again.

The problem with Macs, and Apple products overall, is that they are usually so reliable that when you have an issue, you are almost unprepared to deal with it. Growing up with DOS/Windows, I knew all the tricks, from creating/editing/modifying/replacing autoexec.bat and config.sys for DOS and resolving IRQ conflicts and DLL hell in Windows, it was all part of life using Bill Gates' operating systems.

Back to my Mac issue. I will save all the gory details at the end on all my unsuccessful attempts, as most people that read this would rather learn how to quickly fix this issue than to go through all the unsuccessful steps. But I will cover two specific things that are important to know: a design flaw for Safe Boot and a partial backup to Google Drive via Recovery Mode.

First, Safe Boot is akin to Safe Mode in Windows, where the Mac will load a limited number of things to help you ascertain what is causing this issue. In my case, I just wanted to get past the boot screen. But here is the design flaw, because Mac (at least in High Sierra, not sure how far back this goes) allows full drive encryption via FireVault, you have to login once to decrypt your drive and then you will be shown the login screen again to actually login via Safe Boot. This is not mentioned anywhere! So when I held down the Shift key right after I hit the power button, I did not see the words "Safe Boot" in the upper right hand corner indicating I entered Safe Boot. I know Apple has implemented a plethora of security measures in the last few years to prevent security intrusion on the Mac, but did they really have to obfuscate the words "Safe Boot" until after I typed in my password?

Second, Recovery Mode is something that is built into the Mac. It lets you run hardware diagnostics and even re-install the operating system. Dell and others have copied this idea but their execution is not half as superb. With the Mac, almost everything is fully functional, including WiFi. Obviously, there's no point to have WiFi without a browser, so Safari is also integrated in Recovery Mode. Here is what's cool, say you (in this case, I) never backup any of the files on the system, this is my opportunity to do it. Of course, you have to go into disk utility to mount the drive first, but that is part of Recovery Mode, so it is just exiting and entering different apps in Recovery Mode (there is no app switching), manually logging into Google Drive in Safari, and I can drag folders here for cloud backup. Not the best way to backup files but it works!

Solution (in case you lost patience and started scrolling through)

Now that I covered those two items, let me explain how I fixed this issue. Since not all stuck at boot issues are the same, the best way is to check the crash logs. In my case, the logs indicated the LSD (Launch Service Daemon, not the stuff Steve Jobs tripped on back in the day) was crashing or hanging (depending on which log and how long I waited at the boot). At this point (after spending several hours researching and reading about this issue), I knew the LaunchServiceDaemon is loading one of the .csstore files (it is a cache file generated by the OS) and I saw one that was generated on the day when the Mac first failed to boot. I renamed the file by appending ".backup" in the extension, and Viola! My Mac started booting normally. It lost all the customization including the background picture and the apps I had added to the dock, but at least my Mac is operational again. Whew! Even though I didn't lose any files, it certainly taught me a lesson on backing up the files on my Mac. Read on if you want all the gory details for all the unsuccessful attempted fixes I tried and the issues I had running Time Machine to backup my files.

Gory Details

I probably spent at least an hour trying to perfect my timing to get into Safe Boot. A lot of people online mention waiting for the startup sound before pressing the shift key (or any of the other combinations to get into recovery, verbose or single user mode), but that is bollocks. You can press it as soon as you let go of the power button (https://support.apple.com/en-us/HT201262). Besides, I muted my Mac before the unsuccessful startup, so I never heard the startup sound. The startup sound came back after I restarted the NVRAM (https://support.apple.com/en-us/HT204063), which saves settings including sound volume, part of the dozens of various things I tried troubleshooting this issue.

After failing to get into Safe Boot via the Shift key, I follow Apple's instructions (https://support.apple.com/en-us/HT201262) and used Terminal to force Safe Boot by modifying the "boot-args". It took an extra step in single user mode as you have to enable read/write on Macintosh HD to accomplish this. When I did modify the "boot-args", I still couldn't get into Safe Boot as I wasn't aware of the obfuscation that I mentioned earlier. Although I'm certain the issue I had prevented the Mac from entering Safe Boot because it is the first login that it was stuck on.

Other attempts I tried was simply get a USB drive to work so I can start backing up the files and prepare for an OS re-installation. But I never got any USB drive to work. In single user mode, the USB drives I used were not recognized. I read from this blog post (https://alvinalexander.com/mac-os-x/mac-osx-single-user-mode-usb-drive) that I needed to load additional drivers in single user mode for these USB drives to work, but I never got it to work as the blog post didn't cover that in detail. In Recovery Mode, the USB drives were recognized, but I wasn't able to mount them using DiskUtil (https://wphosting.tv/how-to-mount-and-unmount-drives-in-macos-and-os-x-from-the-command-line/). It is important to note that this all happened before I figured out how to use Google Drive to backup some of the more important files on my laptop. Once I did, I dropped all other attempts to get a USB drive to work as I figured I backup the files I needed via Google Drive.

Looking back, I myself made things difficult, not because I intended to, but because of the choices I made a while ago. One specific thing is I disabled guest accounts as I read at least a year ago that hackers are able to use the guest account to escalate privilege and gain system access. But by doing so, I wasn't able to delete/rename the .csstore files that caused this problem. I would have saved hours of troubleshooting time if I didn't disabled the guest account..

That about covers most of the unsuccessful attempts to resolve the issue. I pretty much tried all the options available in Recovery Mode with no luck until I renamed the .csstore file. I'm sure I tried a few other things but I'm too tired to recall them at this point. So let me go over the backup process instead.

Backup Issues

So as soon I got my Mac operational, I look into using Time Machine to run a full backup. But I kept getting this error message: "Time Machine did not back up because FileVault was encrypting or decrypting a disk. Backups will resume once FileVault finishes." I thought it was referring to the encryption on the external USB drive so I disabled encryption. That took like 6 hours but didn't do anything. I finally thought, why not just go look at FireVault and see what it was doing. Surprisingly, it was decrypting my Mac's main drive. I'm guessing one of many troubleshooting attempts I made include disabling FireVault, although that action did not take place until after I was able to boot into my Mac. The problem was, when the drive was decrypting, every action I take from opening Safari or closing the calculator would change the estimated completion time from 5 hours to 18 hours or longer. I then realized the my effort to decrypt my backup disk actually slow or even stopped the decryption process for FireVault. I decided to close out of every application but left the Time Machine backup drive connected and automatic backup enabled. Not only did it take less than 3 hours to finish decrypting my drive, the Mac automatically started the backup process and was 20% done when I check in on the progress. So even though the FireVault error isn't as clear as it could have been (they could have specify the drive that it was encrypting/decrypting that was preventing the backup process) the backup process is really painless compare to Windows.

Conclusion

Given the computer advances of the last 20+ years, I'm still kind of surprised how concepts like safe mode and recovery mode are relatively the same. It is nice that recovery mode is internet enabled but Apple certainly could have done more to make the process easier. Granted, I'm sure most people would have headed to the local Apple store and paid for help from the Genius bar (unless you pay for extended Apple Care, you almost certainly will have to pay for a fix like this).