Apple - What is the 'Mac OS X Base System' disk image on my 2011 MacBook AIr?

It's rather complicated, and actually a lot of the complexity is to avoid wasting space; I don't think you can "reclaim" anything without breaking it.

Let me start at the beginning: your hard drive (/dev/disk0) has two relevant partitions: Macintosh HD (your regular startup volume), and Recovery HD.

(Update: with newer versions of macOS running from an APFS volume, there'll instead be a single APFS "container" on the disk; the volumes under it will be listed separately under a "synthesized" device, probably /dev/disk2. And in addition to Macintosh HD and Recovery, there'll probably be Preboot and VM volumes, and starting in Catalina there'll be a separate "Macintosh HD - Data" volume holding the user-modifiable parts of the main filesystem. And some other details are different, but actually not that much.)

Recovery HD is marked in the partition table with the type Apple_Boot, but is actually in the normal HFS+ format. It contains minimal booter files and kernel, and at /com.apple.recovery.boot/BaseSystem.dmg, a disk image with a stripped-down and tweaked copy of OS X. The booter mounts this volume (it attaches as /dev/disk1), and transfers to OS X running on it. This is the Mac OS X Base System.

Notice that the Recovery HD is only 650MB, but Mac OS X Base System is 1.4GB? That's because it's a compressed disk image (and I'm pretty sure that compression is the reason they bother with all this disk image trickery). Actually, BaseSystem.dmg is compressed down to only 451MB (at least in OS X v10.7.0).

Also, the volume naming is somewhat inconsistent. You've got /dev/disk1s3 named "Recovery HD", but for some reason it's mounted as "/Volumes/Image Volume" in recovery mode. BaseSystem.dmg has a volume named "Mac OS X Base System".

So that's disk0 and disk1; what about the rest? I'm not certain, but I'm pretty sure they are RAM disks to save temporary data in folders OS X modifies as it runs (remember that in recovery mode, you're running from a read-only disk image). Running the mount command in recovery mode is informative:

$ mount
/dev/disk1s3 on / (hfs, local, read-only)
devfs on /dev (devfs, local, nobrowse)
/dev/disk2 on /Volumes (hfs, local, union, nobrowse)
/dev/disk3 on /private/var/tmp (hfs, local, union, nobrowse)
/dev/disk4 on /private/var/run (hfs, local, union, nobrowse)
/dev/disk5 on /System/Installation (hfs, local, union, nobrowse)
/dev/disk6 on /private/var/db (hfs, local, union, nobrowse)
/dev/disk7 on /private/var/folders (hfs, local, union, nobrowse)
/dev/disk8 on /private/var/root/Library (hfs, local, union, nobrowse)
/dev/disk9 on /Library/ColorSync/Profiles/Displays (hfs, local, union, nobrowse)
/dev/disk10 on /Library/Preferences (hfs, local, union, nobrowse)
/dev/disk11 on /Library/Preferences/SystemConfiguration (hfs, local, union, nobrowse)
/dev/disk12 on /Library/Keychains (hfs, local, union, nobrowse)
/dev/disk0s2 on /Volumes/Macintosh HD (hfs, local, journaled)
/dev/disk0s3 on /Volumes/Image Volume (hfs, local, read-only, journaled)

Those "union" attributes mean that things in the relevant folder in the startup volume will be visible, but anything modified gets stored in what I'm pretty sure is a RAM disk.

If you want to look at this stuff yourself, you can mount the relevant volumes from the regular OS:

# Mount "Recovery HD":
$ diskutil mount /dev/disk0s3
# Mount "Mac OS X Base System":
$ hdiutil mount /Volumes/Recovery\ HD/com.apple.recovery.boot/BaseSystem.dmg -noverify

Tags:

Partition