If you try to figure out how much Disk space you have with a tool Space Gremlin, you could be in for a big surprise because the disk layout has changed. If you have say a 1TB Mac disk, it will show that you have 2TB and there is a new volume called “Macintosh HD – Data) that is identical to what is in the traditional “Macintosh HD”. So what is going on?
Well, with MacOS Catalina, to improve protection against viruses, they have made most of the system files read only with the same trick they used in IOS. That is, the root file system is read only and then then the user files typically in
/User are linked to a writeable partition called Data. This prevents hacking and changing.
Under the covers, this is done with their new APFS (Apple File System) that allows each volume to have roles such as System or Data or Bootable, this makes things much more secure. They use something called an APFS Group so that these volumes can dynamically share space in a single physical disk area, so these aren’t the really inconvenient fixed partitions of the past.
The other trick is the introduction of something called a “firm link”. This means that unlike a soft link which is one way or a hard link which actually has the file system point to the same inode for a file, this is somewhere in between and works on directories. It let’s for instance some of the applications in /Applications be read-only and some to be read-write. Nice trick!