When your Mac starts up, some file somewhere has to be the first file executed. This file, and the folder that contains it, is pointed to by from a fixed location (the Boot blocks) on an HFS+ volume. The file is called the blessed file, and the folder containing it is called the blessed folder. Having these fields filled in is what makes a volume bootable.


Begin trip down memory lane: On the original Macintosh, before HFS, the filesystem was flat. Folders existed only in the imagination of Finder, which obviously has not started running yet when the system is just booting up. The name of the blessed file (normally "System") was stored in the boot blocks.

HFS introduced folders, and the folder ID of the blessed folder was stored in the boot blocks, along with the name (still normally "System") of the blessed file, which was searched for only in that folder. Finder would automatically bless the first folder it saw containing both "System" and "Finder" (configurable in the boot blocks), and unbless any folder that you removed either "System" or "Finder" from. The fact that a blessed folder has been selected is what makes a volume bootable.

HFS+ replaced the names ("System" and "Finder") in the boot blocks with their inode numbers. The boot blocks contain the inode numbers of the blessed folder and the blessed file. (It also saves alternates of these, so that a single disk volume can boot into either OS X or Mac OS 9 or, in principle, some other OS. Press X or 9 at startup to select from the alternates, if any.)

End trip down memory lane.


The OS X installer sets the blessed folder to /System/Library/CoreServices, and the blessed file to /System/Library/CoreServices/boot.efi. You can see this by running the Terminal command:

bless --info

So, that's what boot.efi is intended to be. It's the very first file executed when you start up your system, and is the one responsible for getting everything else started.

Time Machine will, of course, back it up. If it didn't, a full disk restore wouldn't be bootable.

As of OS X 10.7 Lion, the installer will also try to create a Recovery HD partition. It sets the blessed folder of that to ./com.apple.recovery.boot, and the blessed file to ./com.apple.recovery.boot/boot.efi.

As of OS X 10.7.2, Time Machine backs up Recovery HD. Since Recovery HD may change (for example, if you upgrade the OS, or if you back up multiple machines to the same local disk and they're running different versions of the OS), it may have multiple backups of Recovery HD. It keeps them all in separate subfolders of backupvolume/Backups.backupdb/.RecoverySets. Each backup will have its own copy of com.apple.recovery.boot/boot.efi.

Then Time Machine sets the blessed folder of the Time Machine volume to the root folder of that volume, and the blessed file to tmbootpicker.efi. That makes the TM volume bootable. tmbootpicker.efi's job is to search through the Recovery HD backups in Backups.backupdb/.RecoverySets to find the right one for this machine, and transfers control to its boot.efi file. The boot continues as if you had booted into the Recovery HD partition that was backed up there.

In short, it is not unusual to find many copies of boot.efi scattered around your system. You should expect to see one in /System/Library/CoreServices on every volume you've installed OS X on, and in every TM backup of that volume. If you look under the right rocks, you'll also find one in the com.apple.recover.boot folder on every Recovery HD partition, and on each Time Machine volume backing up such a partition. There's also one inside the InstallESD.dmg file inside each OS X installer. Some of those rocks aren't exactly easy to look under. laugh

There's no reason for it to appear anywhere else, though. Anti-malware software might find it suspicious to find one where it's not expected.

boot.efi is typically locked. (tmbootpicker.efi is typically both locked and hidden.) You can't normally empty locked files from the Trash. You can unlock a file in Finder using Get Info and unchecking the Locked checkbox, or from Terminal using chflags nouchg files.... Holding down the option key when emptying the Trash will normally automatically unlock locked files, but boot.efi is normally owned by root, and you don't have permission to unlock it.