big sur left a volume in disk utiliry

Hi marlon j,

macOS Big Sur changed the boot process. The "volume" that you're trying to delete is actually an APFS snapshot, and it's also now your startup disk.

In macOS Catalina, Apple split the boot volume into two APFS volumes: a read-only System volume for macOS, and a writable Data volume for your data. This ensured that no apps or malware could directly modify critical system files, and kept your Mac safe and secure. However, there were a few caveats:

• If System Integrity Protection (SIP) was disabled via Recovery Mode, an administrator could mount the System volume as read-write. This would persist until the next reboot.
• Any changes made to the System volume, whether done via another OS, Recovery Mode, or through macOS with SIP disabled, would persist across reboots.

Before we look at macOS Big Sur, it's crucial to know what APFS snapshots are. In short, an APFS snapshot is an exact copy of an APFS volume, frozen at that particular point in time. Snapshots are read-only in nature and cannot be modified. Thankfully, they take up no additional space. (Note however, that if you delete some files after creating a snapshot, they will be removed from Finder, but they will secretly remain on disk for the snapshot, and continue to occupy storage until the snapshot is deleted.)

At installation time, the Big Sur installer takes additional steps to ensure that the System volume is extra secure. Once the correct system content is installed, the installer seals the System volume with a series of hashes and Apple signatures. It then creates a snapshot of the System volume - a perfect, signed copy that's frozen immediately, and protected from deletion. This snapshot's name always starts with "com.apple.os.update".

At boot time, the system searches for a valid snapshot to start up from. If it finds one, it verifies the seal (Apple's hashes and signatures) on the snapshot. If the snapshot is correctly sealed (a perfect replica of the System volume at installation time), the system proceeds to start up, and uses that perfect snapshot as its System volume. Because the system uses a snapshot as its boot volume, it is outright impossible to modify the system contents of the live-running macOS. Changing the actual System volume does nothing - the system always boots from the perfect snapshot made at installation time.

If the system can't find a valid, sealed snapshot at boot time, it will refuse to boot. On Macs with Apple Silicon or the T2 Security Chip, macOS Recovery will be launched, and you'll be prompted to reinstall macOS.

In addition to the above, system snapshots also provide better update protections. If an update fails, the system simply rolls back to the previous sealed snapshot - instantly undoing the failed update. (If an update succeeds, a new sealed snapshot is created, and the old one is removed.)

Hi shrimpnotes,

I'm not sure whether the issue you're describing is relevant to this thread. It'd be best to start a new discussion regarding this issue.

Nonetheless, I recommend doing the following:

1. Eject and disconnect any external drives connected to your Mac.
2. Open Disk Utility, which is located in Applications -> Utilities -> Disk Utility.
3. In the sidebar, note the volumes that are shown:

• • APPLE SSD (or some other drive name in ALL CAPS at the very top): This is the name of your internal SSD and can be disregarded.
  • Container disk(something): If you see the name of your internal SSD as well, this can be disregarded.
  • Macintosh HD: This is your live system volume, and usually isn't mounted in Big Sur.
  • com.apple.os.update... : This is your system snapshot, and contains your macOS system.
  • Macintosh HD - Data: This is your data volume. All of your third-party apps, user accounts, files and other data reside on this volume.

If you see any other volumes, please let me know and link to a new discussion :)

Hello, what should I do if this volume's size 454 GB. My disk is almost fool and I get notifications about the capacity of the disk(