Haven’t Macs and macOS changed over the last six years? Here are some fictitious diary entries.

July 2015, iMac Retina 5K 27-inch, 3 TB internal hard disk, OS X 10.10 Yosemite

Something has gone wrong with Preview, which doesn’t seem able to open PDFs properly any more. Thankfully, you’ve got a clone, so it’s easy to trash the app and replace it. But that doesn’t make matters any better, and now the Finder is playing up too.

You restart your Mac, but the problems remain. A quick check in Disk Utility finds a minor error in the file system, which you repair. You decide the best thing to do is to reinstall OS X, which restores normal function.

You don’t know, though, whether the disk error was to blame, or whether something else, either a wayward app or even malware, was at fault. After a scan with your anti-virus software, you presume it was just one of those things, and has been repaired anyway.

Your boot disk has two partitions, one of which contains OS X and all your data files in a fairly traditional hierarchy, with a journalled HFS+ file system which is known for its propensity to develop minor errors, and needs periodic maintenance to keep it in good shape. Every month or two, you let Disk Warrior rebuild the file system, to keep it in best form, and you may use a tool to defragment the disk as well. All that protects the system are standard Posix permissions, as System Integrity Protection has yet to come. Like all hard disks, yours occasionally develops an error, but doesn’t seem to be accumulating bad blocks.

The secret lies in your periodic maintenance.

July 2019, iMac Retina 5K 27-inch, 3 TB internal Fusion Drive, macOS 10.14 Mojave

When you hit similar problems four years later, your Mac’s now booting from Apple’s new file system APFS. Although the system is protected by System Integrity Protection (SIP), your Fusion Drive still stores files on its hard disk. APFS is fairly new, and has only recently supported Fusion Drives, so you’re unsure whether this is a hard disk or file system problem. At least this shouldn’t just be a random app tinkering with system files.

Because of SIP, you’re now limited in what you can do to repair system problems. When you check your Fusion Drive, Disk Utility doesn’t report any errors, but does give a couple of warnings which don’t exactly make sense. If a restart doesn’t fix the problems, it looks like reinstalling macOS is going to be the best solution.

A standard APFS boot disk in Mojave consists of an EFI partition and the main APFS container. Within the latter are a minimum of four APFS volumes:

• the startup volume, by default on the internal disk named Macintosh HD, which forms the root of the boot file system,
• Preboot, a small volume of around 40-50 MB,
• Recovery, the Recovery Volume, of around 500 MB,
• VM, containing virtual memory caches, which is upwards of 20 KB depending on use.

July 2020, iMac Retina 5K 27-inch, 3 TB internal Fusion Drive, macOS 10.15 Catalina

A year later, you and macOS are now juggling with separate System and Data volumes in the System Volume Group. APFS has matured, and this time Disk Utility seems completely happy with your Fusion Drive.

Although no app or malware should have been able to damage the System volume, as it’s now read-only, it’s not at all straightforward for you to repair, so it’s probably time to reinstall macOS and see whether that fixes the problems.

Catalina splits the startup volume into two, resulting in five APFS volumes in the one container:

• the read-only System volume, by default on the internal disk named Macintosh HD, which forms the root of the boot file system,
• the writable Data volume, by default on the internal disk named Macintosh HD – Data, which is normally hidden from view at /System/Volumes and accessed via firmlinks,
• Preboot, a small volume of around 40-50 MB,
• Recovery, the Recovery Volume, of around 500 MB,
• VM, containing virtual memory caches, which is upwards of 20 KB depending on use.

July 2021, M1 iMac 24-inch, 2 TB internal SSD, macOS 11 Big Sur

This year you’re using a shiny new M1 iMac in a colour of your choice. When you boot macOS, it loads it from a snapshot which is cryptographically sealed. If anything has gone wrong with that snapshot, it’s detected during the Secure Boot process, and your Mac is put into Recovery for you to install a fresh Sealed System Volume.

If Preview or the Finder start misbehaving, all you have to do is restart your Mac. If it then runs normally, you can turn your attention to potential issues in their preference files, or third-party software. You can have confidence that your Mac has booted from a pristine copy of the System volume which is identical to that installed at the last update.

Your M1 Mac’s internal storage now has three separate containers, with distinct functions.

The first, Apple_APFS_ISC, is the iBoot System Container (iSC), and supports the iBoot firmware in the early boot process, as well as providing trusted storage for the Secure Enclave within the M1 SoC. Like the two other containers, it can have designated ‘booter’ and ‘recovery’ volumes, indicated in the above diagram by an asterisk * next to the volume name. Here, the iSCPreboot volume is the designated booter, and the empty Recovery volume is for recovery. The xART volume provides trusted storage, while the Hardware volume contains hardware-related files such as logs and activation data.

The Apple_APFS_Recovery container is dedicated to providing recoveryOS (or 1 True Recovery), which is stored on its Recovery volume. This includes a second part of iBoot and all that’s necessary for the M1’s full Recovery Mode.

The normal boot container Apple_APFS contains the volumes inherited from Catalina, with one major difference: the System volume is now unmounted altogether, and the Mac actually boots from a snapshot of the volume which is sealed using a tree of cryptographic hashes, and is immutable.

Old habits die hard. But treating the internal storage of an M1 Mac as if it is was still running Yosemite makes as much sense as defragmenting its SSD.