ACSP File System and Storage 2 — Questions and Answers
Question 1: In APFS, what is a 'volume group' and how does it relate to the macOS system and data volumes?
- A volume group contains multiple APFS volumes that share the same storage pool, including the sealed read-only System volume and a writable Data volume (Correct answer)
- A volume group is a RAID configuration that mirrors two APFS volumes for redundancy
- A volume group is a logical container that allows multiple users to share a single APFS volume
- A volume group encrypts multiple volumes with a single shared password
Correct answer: A volume group contains multiple APFS volumes that share the same storage pool, including the sealed read-only System volume and a writable Data volume
In macOS, the APFS volume group contains at least two volumes sharing the same APFS container: a read-only, cryptographically sealed System volume (macOS files) and a writable Data volume (user data and apps). They appear as one disk in Finder.
The macOS system uses an APFS volume group architecture where the System volume (com.apple.os.update) is cryptographically sealed and read-only — it cannot be modified even by root, making it tamper-resistant. The Data volume holds user accounts, third-party apps, and other mutable data. Both volumes share the same APFS container (and thus the same physical storage space). macOS uses firmlinks (bi-directional, lightweight links) to stitch them together into a unified directory tree. Technicians see this in 'diskutil list' as separate volumes with 'System' and 'Data' suffixes.
Question 2: What is a 'firmlink' in APFS and how does it differ from a symbolic link?
- A firmlink is a bi-directional, file-system-level hard link between two volumes that behaves like a directory, while a symlink is a one-directional pointer to a path (Correct answer)
- A firmlink is an encrypted version of a symbolic link that requires admin authentication to follow
- A firmlink is a link that persists across reboots while symlinks are temporary
- A firmlink links files within the same volume, while symlinks can cross volume boundaries
Correct answer: A firmlink is a bi-directional, file-system-level hard link between two volumes that behaves like a directory, while a symlink is a one-directional pointer to a path
Firmlinks are a new APFS link type that creates a true bi-directional, kernel-level tunnel between paths on different volumes (like System and Data volumes), making them appear as a single path. Unlike symlinks, they are fully transparent to applications and cannot be easily broken.
Firmlinks were introduced with macOS Catalina to support the System/Data volume split. For example, /Applications on the System volume is firmlinked to /Applications on the Data volume, so apps and system apps coexist under /Applications seamlessly. Unlike symlinks (which are just path references and can be followed across the network or broken if the target moves), firmlinks are kernel-enforced pairs that always stay in sync. 'diskutil apfs listVolumeGroups' and '/usr/share/firmlinks' show the firmlink configuration.
Question 3: What does APFS 'space sharing' mean in the context of disk management?
- Multiple APFS volumes in the same container share the total available space, with no fixed partition sizes assigned to individual volumes (Correct answer)
- APFS volumes can be accessed simultaneously by multiple users without performance degradation
- An APFS container can be shared over the network as a shared disk
- Multiple Macs can share a single APFS volume for collaborative file storage
Correct answer: Multiple APFS volumes in the same container share the total available space, with no fixed partition sizes assigned to individual volumes
APFS space sharing means all volumes within an APFS container draw from the same shared pool of free space. No fixed size is allocated to each volume — they all grow and shrink dynamically, eliminating the partition size planning problem.
In traditional HFS+ partitioning, each partition had a fixed size allocated at creation time. With APFS, all volumes in a container share the container's total capacity. A container with 500GB and four volumes means all four compete for the full 500GB. Each volume only uses what it needs, and free space is available to whichever volume needs it. You can set optional quota (maximum) and reservation (guaranteed minimum) sizes per volume. This is why 'diskutil list' shows APFS containers with multiple volumes but only shows total size at the container level.
Question 4: Which Disk Utility operation should be used when a volume shows errors in the First Aid check?
- Run First Aid again after booting from macOS Recovery or an external startup disk (Correct answer)
- Reformat the volume immediately to resolve all file system errors
- Use Time Machine to restore the volume from the most recent backup
- Run 'fsck' from single-user mode without First Aid
Correct answer: Run First Aid again after booting from macOS Recovery or an external startup disk
When First Aid reports errors that cannot be repaired on a mounted boot volume, the correct approach is to boot from macOS Recovery or an external startup disk and run First Aid from there, since a volume cannot fully repair itself while it is mounted and in use.
Running First Aid on a mounted, active boot volume has limitations because macOS is actively writing to it. For thorough repair, boot to macOS Recovery (hold Cmd+R on Intel or hold Power button on Apple silicon), open Disk Utility, and run First Aid on the internal volume from there. Alternatively, boot from an external macOS installer or another Mac in Target Disk Mode. For severe corruption, 'fsck_apfs -y /dev/disk1s1' in Recovery Terminal provides the most direct repair. Only reformat as a last resort after backing up all data.
Question 5: What is the purpose of the 'Signed System Volume' (SSV) in Apple silicon and T2 Macs?
- It cryptographically seals the macOS system files so any unauthorized modification is detected at boot and the system refuses to start (Correct answer)
- It signs all user-installed applications with the system's private key to verify their authenticity
- It encrypts user home folders with keys derived from the system hardware
- It prevents the system volume from being read by unauthorized external tools or boot disks
Correct answer: It cryptographically seals the macOS system files so any unauthorized modification is detected at boot and the system refuses to start
The Signed System Volume (SSV) creates a cryptographic hash tree (Merkle tree) of all macOS system files. At boot, the kernel verifies this seal — if any system file has been modified or tampered with, the Mac detects the mismatch and refuses to boot from that volume.
SSV was introduced in macOS Big Sur (11.0). The integrity of every file on the System volume is verified against a Merkle hash tree at mount time. This makes it impossible to modify macOS system files (even by root) without invalidating the seal and preventing the system from booting — a major security improvement over SIP alone. The seal hash is stored in the APFS volume metadata. When macOS updates are applied, Apple re-seals the System volume with a new valid hash. Attempting to modify system files (e.g., for kernel extensions) breaks the seal and requires disabling SSV in Recovery.
Question 6: What storage interface do all Apple silicon Macs use for their internal SSD?
- NVMe over a custom Apple fabric integrated directly with the SoC (Correct answer)
- SATA III connected through a dedicated Apple controller chip
- PCIe x4 using a standard M.2 slot accessible for user replacement
- UFS 3.1 storage packaged within the M-series chip module
Correct answer: NVMe over a custom Apple fabric integrated directly with the SoC
Apple silicon Macs use NVMe storage connected through Apple's custom die-to-die fabric (the same substrate as the SoC), providing extremely fast storage access. The NAND flash is soldered directly to the logic board and shares the unified memory architecture.
Apple silicon Macs use NVMe SSD storage that communicates through Apple's custom interconnect fabric on the same package as the M-series chip. This design enables much lower latency and higher bandwidth than typical PCIe NVMe implementations. The storage NAND is soldered to the logic board and is not user-replaceable. This integration also enables Apple's secure enclave to manage hardware-level encryption of the storage. The theoretical bandwidth varies by chip generation, with M-series chips achieving 5-10+ GB/s sequential read speeds. This architecture is why upgrading RAM or storage in Apple silicon Macs requires buying the right configuration upfront.
ACSP File System and Storage 2
In APFS, what is a 'volume group' and how does it relate to the macOS system and data volumes?