Help reorganizing iMac 27"

fbx

Member
Joined
Feb 3, 2025
Messages
10
Reaction score
0
Points
1
Had my 27" iMac since 2020-21. Now have confusing setup where the Mac basic files are on a subdirectory and not the literal boot drive. Trying to figure how to remedy so that the 4 basic directories (Applications, Library, System, and Users) are back in the actual boot drive (iMac27) and not in the subdirectory (Fred Decoder). Please see attached snapshots of the iMac27 and Fred Decoder directories.

Instead of being in the boot directory iMac27 the basic Mac files are on the subdirectory FredDecoder. How to return them safely to the boot drive (iMac27)?

Many thanks for any help offered.

fb

Screenshot 2025-02-03 at 10.41.54 PM.jpg
 
Joined
Jan 1, 2009
Messages
16,383
Reaction score
4,741
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 16 Pro, plus ATVs, AWatch, MacMinis (multiple)
Welcome to the forum. What version of macOS are you using? And, if you can, please post a picture of Disk Utility with your internal drive selected. In that picture, please ensure that the "View" is set to "Show all Devices." The setting is the "View" button on the top bar of the Disk Utility window.
 
OP
F

fbx

Member
Joined
Feb 3, 2025
Messages
10
Reaction score
0
Points
1
Sequoia 15.3

And this weirdness in Disk Utility

Far as I know: main drive is called (I thought) iMac27 and the one called Fred Decoder are in use.
Bologna is a drive I tried but failed to set up & i don't know what "Container disk3" and "Creedence . . ." are. Possibly something else I tried to set up and eventually gave up on. Looks to me like I royally mangled things

fb

Screenshot 2025-02-04 at 4.36.53 PM.jpg
 
Joined
May 21, 2012
Messages
11,326
Reaction score
1,606
Points
113
Location
Southern New England
Your Mac's Specs
2024 M4 14" MBP, iPhone 16 Pro Max, Watch S7 & Watch S9, AirPods Pro 1
It looks like you are booted from a cloned drive?
 

Rod


Joined
Jun 12, 2011
Messages
10,478
Reaction score
2,537
Points
113
Location
Melbourne, Australia and Ubud, Bali, Indonesia
Your Mac's Specs
2021 M1 MacBook Pro 14" macOS 14.5 Mid 2010MacBook 13" iPhone 13 Pro max, iPad 6, Apple Watch SE.
It looks like you are booted from a cloned drive?
Yeah, I get why Jake wanted the DU view. I think I'll say nothing until I see that.🤔
 
Joined
Jan 1, 2009
Messages
16,383
Reaction score
4,741
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 16 Pro, plus ATVs, AWatch, MacMinis (multiple)
OK, I think I know what may have happened, and the fix is not easy, sorry.

You have an Intel Mac, probably one with a T2 chip in it for security, or an Apple Silicon Mac. At some point you started changing names of the "drives" you saw, probably within Disk Utility, and you've mucked it up really badly. Getting it back entails re-initializing the drive, reinstalling the OS and then recovering your files from whatever backup you have, but before you do any of that, let me tell you how things in APFS-land are much different from what you may know from older Macs you might have had.

Your iMac uses APFS, which is Apple's new file system, proprietary to them. It replaced the older "Mac OS Extended (Journaled)" format, also called HFS+, when High Sierra was released in 2017. The structure of the boot drive was significantly changed to be optimized for how SSDs work and to provide additional security. Basically, the change physically separated the System files from everything else and then let the OS "glue" them back together logically. That way the boot system could be protected from any malware attack, or user error, while not making the average user have to know what happened behind the scenes, as it were. So, basically partitions were replaced by Containers, but inside those Containers were Volumes, and those Volumes were usually mounted as drives and then made visible in FInder as drives. The biggest difference to the user was that instead of a partition or drive being of a fixed size and therefore having its own free space, all Volumes in a Container shared the free space within that Container, which meant that a user who had a "drive" mounted that needed more space didn't have to repartition the drive, just let the "drive" increase in size into the Container as the Volume increased. Handy for external drives, in particular, but for the most part the internal storage has one Container for the user's use, with two main Volumes within it.

And for security from HS on, the System folder was put on a separate Volume and then made read-only to all but the system itself. The other folders that had been in the root level of the drive, Applications, Library, and Users, were then put on a second Volume in the same Container and left as read/write so that they would function as they had before. To make this change invisible to the "average" user, the OS did a little sleight of hand to merge these two Volumes into one Logical Volume for the user to see. But Disk Utility needed to be able to see the reality of the drive, so users could, and can, see those Volumes there. From Big Sur on, even more security was added for machines with a T2 chip or with Apple Silicon; the system drive was made secure and encrpyted.

OK, with that background, what happened to your machine? Well, the default name of the boot drive is Macintosh HD, and if you opened Macintosh HD in Finder you would see four folders: System, Applications, Library, and Users. But under the covers there were actually two Volumes, one labelled "Macintosh HD" and a second labelled "Macintosh HD - Data." As I said, the system then logically merged the two to become Macintosh HD for FInder.

Later, in Big Sur, Apple added additional security by creating what they call "Signed System Volume" or SSV. The SSV is an image of the operating system as designed by Apple and has a digital signature that has the hashes for every component of the system hashed together into a really tight secure system. At boot time, if the system sees any difference between the digital signature from Apple and the digital signature dynamically generated during boot, the boot is aborted and user alerted by the system going into Recovery Mode. With systems with T2 security chips and Apple Silicon (Mx) chips, the SSV was also encrypted with hardware and further sealed with digital keys. Finally, Apple changed the operating system to run off a snapshot of the boot Volume, not the actual boot Volume. By doing that, if the boot system was corrupted by anything, it could reboot easily off the actual boot system fairly quickly by creating a new snapshot.

To make that all work, Apple then changed in install process to create multiple Volumes and Volumes within Volumes for the system. So, looking at your screenshot, what you see is "Container Disk 1" which is the Container on the boot drive. Then in that Container is a Volume named "Fred Decoder." Normally that would be labelled "Macintosh HD" with the greyed out "volumes" beside the name, just as it is beside "Fred Decoder" in your image. The next entry down is also labelled "Fred Decoder" and is greyed out. That is the SSV and you cannot change it at all. Next is "Fred Decoder snapshot" and that is where the system is actually booted from and runs from. What is in that Volume is the "System" folder and files, just them. Next down in your image is "Bologna 25 - Data." That is where the Applications, Library, and User files and folder are located. The system now logically glues them together to show you in Finder the "Fred Decoder" drive with System, Applications, Library, and Users as if they were on one "drive" as you showed in post #1. In a "normal" system, what is now named "Fred Decoder" is named "Macintosh HD" and what is named "Bologna 25 - Data" is named "Macintosh HD - Data."

What I suspect happened is that somehow you have renamed things because you didn't understand what changed between HFS+ and APFS and what Apple had done for security. You probably used Disk Utility for the names because if the system had created the names they would be "Macintosh HD" and "Macintosh HD - Data" as I said. The system uses the name of the System snapshot to name the logically merged Volumes, so the name Bologna 25 - Data is hidden from Finder altogether. Don't feel bad about those actions as Apple has been really bad at warning users NOT to rename things.

Ok, with all that techy background, how to fix? Well, the best way is to reinstall macOS completely and then use Migration Assistant to migrate your data back to the drive from a good backup, preferably TM or a really good clone. To do that, you can boot from Recovery. Follow these instructions:
Read the directions very carefully, including the linked documents, and follow it strictly. Particularly note this:
  • If the installer doesn't see your disk, your disk might have an issue that requires you to use Disk Utility to erase it. If Disk Utility can’t see it or erase it, your Mac might need service.
And this:
Allow installation to complete without putting your Mac to sleep or closing its lid. Your Mac might restart and show a progress bar several times, and the screen might be empty for minutes at a time.
At the end of the process, once you have formatted the storage and installed the OS completely back to factory state, create you account, log into AppleID with the same account as you have now and use Migration Assistant to put back your data.

Once done, in DU you should see something like this:
Screenshot 2025-02-05 at 12.39.56 AM.jpg
Which is the default arrangement. On the Desktop should be a drive icon labelled "Macintosh HD" and it should also be visible in Finder as "Macintosh HD."

OK, that is the "correct" way to fix the issue. If you want to take a chance, first make a good backup of the system as it is now, then you can try to see if you can rename "Fred Decoder" back to "Macintosh HD" and then rename "Bologna 25 - Data" to "Macintosh HD - Data." I'm not optimistic that this approach will actually work because the snapshot of "Fred Decoder" is the boot snapshot and as I said, as soon as the system detects that the boot and SSV are different it will go into Recovery. So you may have to do the longer way I have described anyway, but once you have the backup, it may be worth giving the rename way a try. Of course, any of your apps that use the full path name may also struggle because what used to be "Fred Decoder" is now "Macintosh HD," but you won't know until you try.

Good luck with it, and please learn from this exercise not to do things in areas where you don't know for absoute certainty what will happen.

Sorry this was so long.
 
Joined
Dec 30, 2022
Messages
943
Reaction score
545
Points
93
Location
Somerset, England
Your Mac's Specs
Mac Mini M1 (8gb Memory / 500 gb Hard drive) Running Sequoia 15.X.X
OK, I think I know what may have happened, and the fix is not easy, sorry.
Wow Jake, that is some comprehensive explaination, well done :)
 
Joined
May 21, 2012
Messages
11,326
Reaction score
1,606
Points
113
Location
Southern New England
Your Mac's Specs
2024 M4 14" MBP, iPhone 16 Pro Max, Watch S7 & Watch S9, AirPods Pro 1
And it also explains why Apple chose to make the OS so secure. Out of the hands of children
 
Joined
Jan 1, 2009
Messages
16,383
Reaction score
4,741
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 16 Pro, plus ATVs, AWatch, MacMinis (multiple)
Thanks, guys. I thought that explaining how it ended up as it is would help others NOT to do the same thing.

After sleeping on it, I think he may be able to recover with some simple renaming instead of having to do the full reinstall. Just rename "Fred Decoder" to "Macintosh - HD" and "Bologna 25 - Data" to "Macintosh HD - Data" and reboot to get a new snapshot made with the name "Macintosh HD snapshot." And I don't think his apps will struggle after the reboot, either, unless they are really stupidly built, in which case they should have blown up when he renamed the two Volumes as they are now.

Not the worst situation with APFS by a rookie. I remember one poster who had multiple Macintosh HD - Data volumes because he kept reinstalling the OS to the Data Volume instead of to the root volume because he didn't know how APFS worked. As I recall, there were 4 or 5 copies of the OS on the drive.
 
OP
F

fbx

Member
Joined
Feb 3, 2025
Messages
10
Reaction score
0
Points
1
Could I just copy whole internal drive (with CCC) then erase everything and install only the material on the current Decoder drive? That sounds too easy. Especially since I don't know what's on other
OK, I think I know what may have happened, and the fix is not easy, sorry.

You have an Intel Mac, probably one with a T2 chip in it for security, or an Apple Silicon Mac. At some point you started changing names of the "drives" you saw, probably within Disk Utility, and you've mucked it up really badly. Getting it back entails re-initializing the drive, reinstalling the OS and then recovering your files from whatever backup you have, but before you do any of that, let me tell you how things in APFS-land are much different from what you may know from older Macs you might have had.

Your iMac uses APFS, which is Apple's new file system, proprietary to them. It replaced the older "Mac OS Extended (Journaled)" format, also called HFS+, when High Sierra was released in 2017. The structure of the boot drive was significantly changed to be optimized for how SSDs work and to provide additional security. Basically, the change physically separated the System files from everything else and then let the OS "glue" them back together logically. That way the boot system could be protected from any malware attack, or user error, while not making the average user have to know what happened behind the scenes, as it were. So, basically partitions were replaced by Containers, but inside those Containers were Volumes, and those Volumes were usually mounted as drives and then made visible in FInder as drives. The biggest difference to the user was that instead of a partition or drive being of a fixed size and therefore having its own free space, all Volumes in a Container shared the free space within that Container, which meant that a user who had a "drive" mounted that needed more space didn't have to repartition the drive, just let the "drive" increase in size into the Container as the Volume increased. Handy for external drives, in particular, but for the most part the internal storage has one Container for the user's use, with two main Volumes within it.

And for security from HS on, the System folder was put on a separate Volume and then made read-only to all but the system itself. The other folders that had been in the root level of the drive, Applications, Library, and Users, were then put on a second Volume in the same Container and left as read/write so that they would function as they had before. To make this change invisible to the "average" user, the OS did a little sleight of hand to merge these two Volumes into one Logical Volume for the user to see. But Disk Utility needed to be able to see the reality of the drive, so users could, and can, see those Volumes there. From Big Sur on, even more security was added for machines with a T2 chip or with Apple Silicon; the system drive was made secure and encrpyted.

OK, with that background, what happened to your machine? Well, the default name of the boot drive is Macintosh HD, and if you opened Macintosh HD in Finder you would see four folders: System, Applications, Library, and Users. But under the covers there were actually two Volumes, one labelled "Macintosh HD" and a second labelled "Macintosh HD - Data." As I said, the system then logically merged the two to become Macintosh HD for FInder.

Later, in Big Sur, Apple added additional security by creating what they call "Signed System Volume" or SSV. The SSV is an image of the operating system as designed by Apple and has a digital signature that has the hashes for every component of the system hashed together into a really tight secure system. At boot time, if the system sees any difference between the digital signature from Apple and the digital signature dynamically generated during boot, the boot is aborted and user alerted by the system going into Recovery Mode. With systems with T2 security chips and Apple Silicon (Mx) chips, the SSV was also encrypted with hardware and further sealed with digital keys. Finally, Apple changed the operating system to run off a snapshot of the boot Volume, not the actual boot Volume. By doing that, if the boot system was corrupted by anything, it could reboot easily off the actual boot system fairly quickly by creating a new snapshot.

To make that all work, Apple then changed in install process to create multiple Volumes and Volumes within Volumes for the system. So, looking at your screenshot, what you see is "Container Disk 1" which is the Container on the boot drive. Then in that Container is a Volume named "Fred Decoder." Normally that would be labelled "Macintosh HD" with the greyed out "volumes" beside the name, just as it is beside "Fred Decoder" in your image. The next entry down is also labelled "Fred Decoder" and is greyed out. That is the SSV and you cannot change it at all. Next is "Fred Decoder snapshot" and that is where the system is actually booted from and runs from. What is in that Volume is the "System" folder and files, just them. Next down in your image is "Bologna 25 - Data." That is where the Applications, Library, and User files and folder are located. The system now logically glues them together to show you in Finder the "Fred Decoder" drive with System, Applications, Library, and Users as if they were on one "drive" as you showed in post #1. In a "normal" system, what is now named "Fred Decoder" is named "Macintosh HD" and what is named "Bologna 25 - Data" is named "Macintosh HD - Data."

What I suspect happened is that somehow you have renamed things because you didn't understand what changed between HFS+ and APFS and what Apple had done for security. You probably used Disk Utility for the names because if the system had created the names they would be "Macintosh HD" and "Macintosh HD - Data" as I said. The system uses the name of the System snapshot to name the logically merged Volumes, so the name Bologna 25 - Data is hidden from Finder altogether. Don't feel bad about those actions as Apple has been really bad at warning users NOT to rename things.

Ok, with all that techy background, how to fix? Well, the best way is to reinstall macOS completely and then use Migration Assistant to migrate your data back to the drive from a good backup, preferably TM or a really good clone. To do that, you can boot from Recovery. Follow these instructions:
Read the directions very carefully, including the linked documents, and follow it strictly. Particularly note this:

And this:

At the end of the process, once you have formatted the storage and installed the OS completely back to factory state, create you account, log into AppleID with the same account as you have now and use Migration Assistant to put back your data.

Once done, in DU you should see something like this:
View attachment 40025
Which is the default arrangement. On the Desktop should be a drive icon labelled "Macintosh HD" and it should also be visible in Finder as "Macintosh HD."

OK, that is the "correct" way to fix the issue. If you want to take a chance, first make a good backup of the system as it is now, then you can try to see if you can rename "Fred Decoder" back to "Macintosh HD" and then rename "Bologna 25 - Data" to "Macintosh HD - Data." I'm not optimistic that this approach will actually work because the snapshot of "Fred Decoder" is the boot snapshot and as I said, as soon as the system detects that the boot and SSV are different it will go into Recovery. So you may have to do the longer way I have described anyway, but once you have the backup, it may be worth giving the rename way a try. Of course, any of your apps that use the full path name may also struggle because what used to be "Fred Decoder" is now "Macintosh HD," but you won't know until you try.

Good luck with it, and please learn from this exercise not to do things in areas where you don't know for absoute certainty what will happen.

Sorry this was so long.

You, sir, are an angel of mercy. I have printed your answer for further study. One thousand thanks for the elaborate and fully detailed explanation of the mess I've made. I'll try to look at this splendid answer a few times and then act. I'll try the rename thing first, as I think you suggest.

Note that this is a 2019 iMac 27" and is, I believe, pre-T2 chip, and I wonder if that makes a difference.

fb
 
Last edited:
OP
F

fbx

Member
Joined
Feb 3, 2025
Messages
10
Reaction score
0
Points
1
Renamed "Fred Decoder" to "Macintosh HD" as suggested and booted from and seems to have all content. Looks in Disk Utility like this.

I could not find "Bologna-25" to rename it and thus could not rename it.

Also don't know what the "APFS Physical Store Disk4" and "Container disk5" are all about.

Also, as far as I can see the boot drive is now Macintosh HD and it seems to have some or maybe all of the content on it.

Thanks for the advice and any steps I might take to rename "Bologna-25" as suggested in prior very kind email.

fb

Screenshot 2025-02-05 at 6.01.08 PM.jpg
 
Joined
Jan 1, 2009
Messages
16,383
Reaction score
4,741
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 16 Pro, plus ATVs, AWatch, MacMinis (multiple)
Use Disk Utility. Click on "Bologna-25 - Data" to get the details in the right side window. Now click on the name in that window to highlight it, backspace over it to erase it and type in the new name. As I said in the long post, the "Data" drive is never mounted separately so FInder will never see it. You can only see it there, in Disk Utility.

I can't help with the "Creedence11M6270.SE..." Volume. Do you know how that came into being? Did you create it or rename something to that? It is listed as a disk image, so did you make it through Disk Utility at some point?
 
OP
F

fbx

Member
Joined
Feb 3, 2025
Messages
10
Reaction score
0
Points
1
1000 thanks. don't know what the "Creedence11M6270.SE..." is. Been using this iMac since 2019 so likely made in distant past. This is what Disk Utility shows me now, thanks to you. Your help immeasurable.


Screenshot 2025-02-05 at 10.11.45 PM.jpg
 
Joined
Jan 1, 2009
Messages
16,383
Reaction score
4,741
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 16 Pro, plus ATVs, AWatch, MacMinis (multiple)
Well, mount the Creedence Volume and then use Finder to see what's in it. You can mount it from DU by clicking once to highlight it, then in the right hand window menu bar click "Mount."
 
OP
F

fbx

Member
Joined
Feb 3, 2025
Messages
10
Reaction score
0
Points
1
Well, mount the Creedence Volume and then use Finder to see what's in it. You can mount it from DU by clicking once to highlight it, then in the right hand window menu bar click "Mount."
/System/Library/AssetsV2/com_apple_MobileAsset_PKITrustStore/purpose_auto/6dd55b0d06633a00de6f57ccb910a66a5ba2409a.asset/.AssetData Screenshot 2025-02-06 at 11.50.04 AM.jpg
 
Joined
Jan 1, 2009
Messages
16,383
Reaction score
4,741
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 16 Pro, plus ATVs, AWatch, MacMinis (multiple)
What is that? All I see is path on the System volume (which is read-only). Where did you get that? DId you mount the drive and then look for what was in it in Finder?

EDIT: I found this discussion on Apple's Communit page:
It woud appear to be something associated with Sequoia, and part of the operating system itself.
 
Joined
May 21, 2012
Messages
11,326
Reaction score
1,606
Points
113
Location
Southern New England
Your Mac's Specs
2024 M4 14" MBP, iPhone 16 Pro Max, Watch S7 & Watch S9, AirPods Pro 1
Can you click the eject button in the sidebar? Is that a Finder window or DU?
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top