Boot disk layout on Intel and M1 Macs: High Sierra to Big Sur

When you format a disk and install macOS on it, making it a startup or boot volume, it has a standard structure, something that has changed greatly over the last few years. This article summarises all you need to know about the layout of volumes on APFS boot disks from High Sierra through to Big Sur, running on both Intel and M1 Macs.

Within the System and Data volumes, standard folders/directories also have fixed layouts, with firmlinks to bind those two volumes together. I will detail those for release versions of Big Sur in an article next week; Catalina and pre-release versions of Big Sur are detailed in this article.

BootDiskStructureMojave

A standard APFS boot disk in High Sierra and Mojave consists of an EFI partition and the main APFS container. Within the latter are a minimum of four APFS volumes:

  • the startup volume, by default on the internal disk named Macintosh HD, which forms the root of the boot file system,
  • Preboot, a small volume of around 40-50 MB,
  • Recovery, the Recovery Volume, of around 500 MB,
  • VM, containing virtual memory caches, which is upwards of 20 KB depending on use.

BootDiskStructureCatalina

Catalina changes that by splitting the startup volume into two:

  • the read-only System volume, by default on the internal disk named Macintosh HD, which forms the root of the boot file system,
  • the writable Data volume, by default on the internal disk named Macintosh HD – Data, which is normally hidden from view at /System/Volumes and accessed via firmlinks,
  • Preboot, a small volume of around 40-50 MB,
  • Recovery, the Recovery Volume, of around 500 MB,
  • VM, containing virtual memory caches, which is upwards of 20 KB depending on use.

BootDiskStructureBigSur

Big Sur goes further than that. The System volume is now the mounted snapshot of a sealed volume known as the Sealed System Volume (SSV):

  • the SSV, a mounted snapshot of the unmounted read-only System volume named Macintosh HD, which forms the root of the boot file system. The snapshot is named com.apple.os-update- followed by its UUID, and the volume (hence its snapshot) is typically about 15 GB in size;
  • the writable Data volume, by default on the internal disk named Macintosh HD – Data, which is normally hidden from view at /System/Volumes and accessed via firmlinks. On Intel Macs, this is given its full name, but on M1s it’s named simply Data;
  • Preboot, a small volume of around 350 MB;
  • Recovery, the Recovery Volume, of around 600-950 MB;
  • VM, containing virtual memory caches, which is upwards of 20 KB depending on use.

Note that, at least in macOS 11.1, the seal on the unmounted read-only System volume is normally broken, but it’s the snapshot which is the important one: that should be sealed (unless you have broken its seal intentionally).

Internal disks of M1 Macs are unusual in that they don’t contain a top-level EFI partition. Instead, they have two additional partitions, named Apple_APFS_ISC and Apple_APFS_Recovery, of about 520 MB and 5 GB size respectively. Neither of those is present on external bootable disks for the M1, where the traditional EFI partition is present instead.

The normal place to look for mounted volumes in Catalina and Big Sur is /System/Volumes. While Catalina normally shows what you’d expect, Big Sur isn’t as straightforward. Instead, you’re likely to see the following in addition to the expected volumes:

  • BaseSystem, an empty folder
  • FieldService, an empty folder
  • FieldServiceDiagnostic, an empty folder
  • FieldServiceRepair, an empty folder
  • Hardware, shown as a volume or folder, containing files and folders
  • iSCPreboot, shown as a volume or folder, containing files and folders
  • Recovery, shown as a folder not a volume
  • Update, shown as a volume, containing files and folders
  • xART or xarts, shown as a volume or folder, which may contain files and folders or appear empty.

Of course the user isn’t supposed to use any of those system-level folders and volumes, and Apple may in a future update hide them away.