

The system volume isn’t even mounted directly (middle), but uses a locked snapshot for even more security (lower left). In Big Sur, macOS is really a volume group of system, Data, and a few other partitions. (The Big Sur volume isn’t even mounted directly, but as a read-only APFS snapshot, making it even harder for an attacker to find a way in.) The system volume is read-only and locked against modification during an active macOS session the Data volume can be read and written, and apps on its may be launched. With the concept of a volume group in APFS, Catalina organized all system files and core apps into one volume and all user-owned and user-modifiable data, third-party apps, and some Apple apps into another.

This culminated in macOS 10.15 Catalina in splitting macOS into two pieces, which appear seamlessly as a single unit in the Finder, but which severed a long-time intermingling of files. Along the way, Apple kept adding more features to APFS. APFS allowed more a sophisticated organization of aspects of macOS in the startup volume’s partition. APFS first became mandatory for SSD-based Macs and then for ones with a Fusion drive. Apple splits the startup volume into two piecesĪpple phased in the process of changing how it organizes the startup volume through a phase in of the APFS (Apple File System).
