Reviewed July 28, 2026 · DiskStory
When DiskStory needs Full Disk Access
Full Disk Access is optional and manual. It expands visibility into protected locations but does not grant root access or bypass SIP.
Direct answer
Use Full Disk Access only when you want a protected-location scan across the startup disk. macOS requires you to add and enable DiskStory in System Settings; the app cannot grant itself access or modify the TCC database.
What the permission changes
It can make Mail, Messages, Safari, and other TCC-protected locations readable to the signed app. DiskStory checks conservatively by opening an existing protected file read-only and closing it without reading bytes.
What the permission does not change
It does not bypass root-only Unix permissions, System Integrity Protection, or Apple private Data Vault rules. Remaining failures stay visible in scan coverage.
What works without it
You can scan a folder you explicitly choose or the currently accessible startup-disk scope. DiskStory does not describe that partial result as a complete Mac scan.